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(PROCEEDINGS ) 
THE CLERK: All rise. 


The United States District Court is now in session. 


You may all be seated. 

Judge, we have 10 jurors here; we're waiting for six. 

THE COURT: All right. Good morning everybody. I'm 
told there are a myriad of issues. 

MR. NEMTSEV: It's not that bad, your Honor. 


MR. KOSTO: Can I start with a couple of simple ones? 


THE COURT: Simple is good. 
MR. KOSTO: What we talked about at sidebar yesterday, 


with Ms. Lewis' help, we just made a very simple chalk with the 


names of the individuals who are coming up in testimony. I 


don't think the defense objects, and we propose to leave this 


basically here. 


THE COURT: Also, it's critical, since I didn't 
understand, so for sure they didn't understand, who are the 


named and unnamed conspirators that you're charging. 


MR. FRANK: Your Honor, there are only three named 


conspirators charged in the count. 


THE COURT: I understand that, and then there are two 
others. 


MR. FRANK: Two others that were involved in the 


scheme, they are Sladkov and Irzak; we haven't really discussed 


them yet. 
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THE COURT: You haven't discussed them at all. Are 
they in on of those pictures? 

MR. FRANK: They are. They are coming up in the 
testimony. 


THE COURT: And then there are others that are 


investors. 

MR. FRANK: They're on there, and we're in the middle 
of discussing them. So we're going to identify them on the 
exhibit and further discuss them. 


THE COURT: That's fine. And then you'll take 


when the government agent is off the stand. 
MR. FRANK: When he's off the stand, sure. 
THE COURT: It was just very difficult to follow 
yesterday who all the pictures were and why they mattered. 
Did you have a problem with it? 
MR. NEMTSEV: No. 
MR. KOSTO: On that theme of trying to make things 


simpler in connect with Agent Hitchcock's testimony, we've 


provided the Court with two proposed chalks, illustrations, to 


aid the jury in understanding Special Agent Hitchcock's 


testimony. There will be a moment -- there will be a segment 


of Mr. Frank's examination of Agent Hitchcock when Agent 
Hitchcock is introducing records from a variety of companies. 


And the chalk puts the names of those companies in front of the 


jury so that Agent Hitchcock can explain what those company do, 


Case 1:21-cr-10104-PBS Document 183 Filed 02/06/23 Page 9 of 176 


and that when the exhibits come in, the jury will see a name, 
for example, we'll be introducing records from Namecheap. 


THE COURT: So it's just a chalk. 


It's just a chalk. 


We provided it to it the defense; they object. 
THE COURT: Why? I don't know enough to know if it's 
accurate enough, but it's just a chalk. 


MR. NEMTSEV: We'll live with it. 


COURT: Fine. 
MR. KOSTO: And we're -- 


THE COURT: You need to make copies of these for 


Maryellen to put in for the appellate record. 

MR. FRANK: She can have those, and as we speak, 
they're being blown up into that size exhibit. 

THE COURT: Thank you. 

MR. KOSTO: The next one, your Honor, from the 


government's perspective, I anticipate that Mr. Frank will ask 


Special Agent Hitchcock about some summary exhibits under Rule 


1006 that were provided to defense well in advance of trial. 
The defense is objecting on the grounds that the evidence that 


they summarize, the voluminous logs from DFIN, are not admitted 


into evidence. 


The government cited United States v. Apollon, among 


many other cases and the rule itself state that the information 


summarized needs to be admissible. 
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THE COURT: But they want to admit it, what's the 
problem? 


MR. KOSTO: What's that? 


They want to admit the geolocation information. 
THE COURT: We're back to the same old same old. 


If they want to admit it and it's admissible, it can 


MR. KOSTO: But at the moment there's no requirement 
for the government to admit -- 

THE COURT: There's no requirement that the government 
put it in as long as it's admissible, but if they want to put 
it in, they can put it in. 

MR. KOSTO: Assuming an appropriate foundation for the 
information. 

THE COURT: Yes. 

MR. NEMTSEV: Okay. 


THE COURT: Now, let me just say this. I did doa lot 


of research even before I got your fiery memos in the middle of 


the night. 


I did find, or, more accurately, my law clerk found 


the Doe case last night, which is a lst Circuit case, which 


seems to allow this to come in on one condition, that it's got 


to be undisputed that the bills were paid. 


MR. KOSTO: I don't think there's any dispute that 


those bills were paid, and I 


think Mr. Nemtsev agrees with me. 
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THE COURT: Is that right? 

Are you going to put that in through this agent? 

MR. FRANK: Yes. 

MR. NEMTSEV: I don't dispute that those bills were 
paid, your Honor. 


THE COURT: Then it seems to me -- 


MR. NEMTSEV: I just dispute that those services were 
provided, which is what the record says. 

THE COURT: I think the way it works, it's my job to 
make a gateway finding of reliability. The thing that had 


thrown me was that it said "unpaid," which would suggest that 


they weren't reliable because somehow they were unpaid. Had a 


big stamp on them says "unpaid." I don't know what that's 
about, and who put the "unpaid" on there. 


MR. KOSTO: There are two copies of that invoice, your 


Honor. The one that we obtained from StackPath from its 
records says "unpaid." The copy that the government obtained 


from Micfo, for which there is no records custodian, is marked 


"paid." The bank records from StackPath show the amounts on 
the invoice were paid from StackPath's bank to Micfo. 

THE COURT: And do you have those records that will be 
admitted? 

MR. KOSTO: We weren't planning to admit the bank 
statements if there's no issue about payment. 


If you'd like Mr. Frank to ask Special Agent Hitchcock 
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if they were paid, he can so testify, because he saw the bills. 


They're not disputed. 


THE COURT: Do we have those bills? 
MR. KOSTO: We do. 


THE COURT: Why don't we just put those in? 


Because I think that's what threw me. Because if you 
have a company that no longer exists for reasons that are 
unsavory, and then you have "unpaid," it doesn't provide me 
with the external indicia of reliability. 

If they're paid, it means that someone felt that it 
was accurate enough, and that's where Doe went with it. 

It's about -- it's about the fact that they were paid 
so that there was enough -- plus, you have other indicia of 


reliability having to do with Boston that you outlined in your 


memo. I've read your brief. 
The question you have is are they allowed to attack it 


at all, by showing, A, you don't have the custodian; the 


original bill says "unpaid" and the company is out of business 


because of a conviction. They should be able to attack to 
reliability, but I'm going to allow in the records; that's 
where we're going to go. 

MR. FRANK: Just to clarify, they're not disputing 
that it's paid. 

THE COURT: That's right. That it was paid, and if 


they want to attack the reliability of the fact that -- of the 
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information in there, they need to be able to do that. I can't 
stop them from doing that. 


But you can't introduce extraneous evidence under any 


of these rules. It's simply a question to the agent: Is the 
company now in existence? Why not? 
MR. FRANK: They can't attack it on the grounds that 


t was unpaid because they don't have a good faith basis for 


THE COURT: I agree. But it does create -- that's 


what stopped me, I have to be honest, is I didn't -- how coul 


you have a company that doesn't exist and it says "unpaid"; 
have no indicia of reliability. 

They have now proffered that in their memorandum last 
night, which was very helpful, this was never a 609 issue, it's 
a business records issue -- 

MR. KOSTO: But if it's not a 609 issue, your Honor, 
609 doesn't permit the use of a corporate conviction to impeach 


the records custodian on the nature of the invoice. 


THE COURT: He's not impeaching the records custodian. 


The issue is -- the records custodian, they paid the invoice. 


MR. KOSTO: Putting -- 
THE COURT: Excuse me, I'm going to let them ask the 


agent why don't we have the records custodian from Micfo, but 


you cannot put in extraneous information. 


They have to put in their case. I can't stop them 
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from putting in their case. 
MR. NEMTSEV: Thank you, your Honor. 
THE COURT: That's where I'm going with that. 
What's next? 
MR. KOSTO: Just so we're clear, they can't go into 
the details of -- 
THE COURT: Right. 


MR. KOSTO: Or introduce extraneous evidence. 


THE COURT: No. We never can under 608(b) or 
equivalent. We're not having a trial within a trial. 

MR. FRANK: Understood, your Honor. 

My question is how that's going to happen. 
THE COURT: You're going to say to the agent: Does 


Micfo still exist? No. 


Is there -- was it convicted of a crime in 2019, or 


whatever that was based on information -- you'll come back to 


say it had nothing to do with this case, right, right. That's 


where it's going to end up. And then they can argue how 


reliable it should be. 
MR. FRANK: On crime. 
COURT: Whatever the crime was. 
MR. NEMTSEV: Wire fraud. 
MR. FRANK: The concern that we have -- 
THE COURT: I understand you have a concern, you want 


this to be a slam dunk. But I have a bigger concern than any 
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of this, which is, I read the Solicitor General's brief going 


up to the Supreme Court on the issue of venue. That's one heck 


of an issue. So the issue that I want you all to focus on as 
I'm doing my verdict form is should I say not guilty by reason 
of lack of venue? 

MR. FRANK: We do not -- I've checked this, your 
Honor, with our appeals unit, and we do not believe special 


verdict forms like that are favored in this district; they are 


disfavored. 

THE COURT: They are disfavored, and I've actually 
never done one. That said, this is very -- issue is teed up. 
So if I get a not guilty, we will not know whether it was going 
to trigger double jeopardy or whether or not it was for lack of 
venue that could arguably have it retried in Denver -- Chicago 
or Minnesota. 

MR. FERNICH: RuSSia. 

THE COURT: So I'm going to instruct them, if there's 


a lack of venue, it's a not guilty. 


What is your desire? 

MR. NEMTSEV: That's our desire. 

I think that's consistent with their desire as well. 
MR. FRANK: Our desire is that they be instructed that 


if any element is not met, they must acquit, but not that there 


be a special instruction for venue -- 


THE COURT: I'm sorry, venue is not a element. That's 
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the one thing that's clear from all these cases. 


separate constitutional requirement. 
I'm going to say if any element is not met or you find 


there's no venue -- 


MR. FRANK: That's fine. Yes, we just object to 


having a special instruction highlighting venue within the 


instruction as a reason to acquit. So if there's a general 
instruction -- 

THE COURT: I'll give you my instructions, but I have 
to give you venue. I think you're both wrong. 

I think the Supreme Court is going to say it's not an 
element. I think they're going to say double jeopardy does not 
exist for venue. 

MR. FERNICH: I think you're right. 

THE COURT: I think that's what's going to happen, and 
I think we're not going to know if there's a not guilty, the 
basis for it. 


But since you are the masters of your destiny, if you 


both agree, I agree. 
MR. NEMTSEV: Thank you. 
THE COURT: So watch what you wish for. 
5O..== 
MR. FRANK: There are still some disputed exhibits. 


MR. FERNICH: Judge, in reading the briefs, did they 


brief Blockburger on its continued vitality in the SG's brief? 


Case 1:21-cr-10104-PBS Document 183 Filed 02/06/23 Page 17 of 176 


YSs 5 
Maybe we should go one by one. 
Do you want to read them -- 


Excuse me, these are objected or not -- 


Objected to. 
So I do need to see them. 
MR. : It may be easier if we all look at them on 
the screen. 
THE CLERK: Do you want a hard copy? 


THE COURT: One of the things I have not liked, this 


is also being selfish on my part, but I imagine for all of you 


and junior staff, is a lot of this seems to get litigated 
between 10 and midnight. 


MR. FRANK: We stipulate that we don't like that 


THE COURT: So is there a way of -- I gave you the 
afternoon so this wouldn't have to happen. 


MR. FRANK: Judge, I think we -- this is the witness 


who has the most exhibits, so I think we're sort of at the end 
of that. 
COURT: All right. 
FRANK: Jen, call up 151H. 
CLERK: What did you say? 
MR. FRANK: 151H. 


This is from the WhatsApp communications between 
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Mr. Klyushin and Mr. Ermakov. 

THE COURT: We've already heard about the sauna. Is 
there more sauna? 

MR. FRANK: Another time they go to the sauna. 

THE COURT: Does it matter timewise? 

MR. FRANK: The fact that they go to the sauna often 
is more probative than the fact that they've been to the sauna 
once. 

MR. NEMTSEV: Relevance and 403. 

THE COURT: Sustained. 

What's the next question? 

MR. FRANK: Todd x 


MR. NEMTSEV: This is the boat. 


MR. FRANK: This is not about the boat, your Honor. 


This is about the relationship between the defendant and 
Mr. Ermakov. 
THE COURT: Excuse me, somebody just knocked. 


THE CLERK: Hold on one second. It's probably the 


jury and they're probably all here. 

(Discussion off the record.) 

MR. FRANK: In this exchange, Mr. Klyushin says to 
Mr. Ermakov, My pleasure is the boat and trading. 


And then he says, Honestly, I get a bigger kick when I 


check apartments for you with you. The fact that we can walk 


home together and have a beer or play golf or simply send 
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everyone to hell knowing that you are close. 
Mr. Ermakov responds: This truly sounds like a 
declaration of love to a girl. 


Mr. Klyushin responds: We spend a lot of time 


together, I feel good and calm, everyone does their job, does 
his own work. 

THE COURT: All right. This is not repetitive. 

T'll allow this in. 

What's next? 

MR. NEMTSEV: Just the first text, At this point I 


want nothing except the boat. 


Like, this boat is going to be the centerpiece of this 
this point, your Honor. He's going to testify -- 
THE COURT: T'll allow that in. 


The sauna one was repetitive. This one is different. 


MR. FRANK: 151K is going to go with the single 
photograph of the boat that we're putting in, just to show that 


there were other photographs. Those are not coming into 


evidence, but we're just showing that there were multiple 


photographs. 


The reason that's relevant is because the special 
agent is going to say that there were also multiple photographs 
of the boat found in Mr. Sladkov's account. We're not showing 
the photographs, it's just the quantity. 


MR. NEMTSEV: Object. 
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THE COURT: Sustained. Objection sustained. 
What's the next one? 
But you'll allow the one picture of the boat. 


MR. NEMTSEV: One picture we're fine with. 


THE COURT: The boat, there's a picture of a boat that 
was sent to Ermakov. 

MR. FRANK: Can we at least elicit there were multiple 
photographs? 


THE COURT: Sure. But we're not going to -- 


MR. FRANK: The next is 151N. 

In this exhibit, they're discussing Mr. Ermakov buying 
an apartment, which he ultimately does, with Mr. Klyushin's 
money. And when they discuss how to earn the money, 


Mr. Klyushin says -- Ermakov says, I better go to work. 


And Klyushin says, No need to, just turn the computer 


on and think about it. 


That is direct evidence -- 


THE COURT: Yes, that's direct. I'll allow that. 


What's the next one? 

MR. FRANK: They're objecting 

THE COURT: You couldn't work these out? 
MR. NEMTSEV: What? 


THE COURT: You guys couldn't work this out? 


Maybe you were too tired last night. 


MR. NEMTSEV: We worked out some. 
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MR. FERNICH: There's a lot more. 

THE COURT: I'm not spending all morning -- how many 
more do you have? 

MR. FRANK: Only a few more. 

COURT: The jury is waiting. 

MR. FRANK: 163 and 163A, they're objecting -- these 
are business records of a company called AirVPN, and they were 
produced -- I'm sorry, Quintex, which is a reseller of AirVPN, 
and it was produced with a business records certification. I'm 
not sure what the grounds for the objection is. 

MR. NEMTSEV: 802, your Honor. 

THE COURT: You know, you throw out 802. What are you 
talking about? 


MR. NEMTSEV: It's a letter to Special Agent Hitchcock 


saying, Here are the answers, this and this and this and this. 
MR. FRANK: That's how they produce a record of IP 
addresses. 


THE COURT: I can't do this on the fly. You'll have 


to give it to me and I'll have to read it. 


MR. KOSTO: While he's pulling it up, Judge, when 
Facebook responds and says, This is our subscriber, this is 
what it looks like. 

MR. FRANK: No different. 


THE COURT: I have never seen this before. I can't 


just read it and speed read for you. 
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MR. KOSTO: We had a stipulation. 


MR. FRANK: We had a stipulation all these business 
records were coming in -- 
THE COURT: Did you stipulate that they came in? 


MR. NEMTSEV: I stipulated that they're authentic. 


MR. KOSTO: You did stipulate that all IP addresses 
that were stipulated as business records come in. 

THE COURT: Did you? 

MR. NEMTSEV: I don't recall that. 

THE COURT: Do you have that? 

MR. KOSTO: I participated in that conversation as 

took that conversation away. 

THE COURT: It's just it's oral. 

I have to read it. 


All right. What's the next one? 


MR. FRANK: The next one are the summary charts that 
Mr. Kosto was describing. These are -- I believe your Honor 


has just ruled on these the summary -- 


MR. NEMTSEV: We can use summaries, they can use 
summaries. 


MR. KOSTO: So this is actually one issue. They 


propose to put in their exhibits and their summaries through 


our witness, which we think is completely inappropriate and not 
proper cross-examination. 


THE COURT: I'll let them do it if he can do it. If 
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he's never seen it before, he can't do it. 


MR. NEMTSEV: It's things he could have seen before. 


COURT: I don't know, you'll have to give hima 


not going to pop it on him. 

NEMTSEV: Okay. 

FRANK: Are you still objecting to 267, the Cogent 
records? 


MR. NEMTSEV: The typed message, yes. 


MR. FRANK: So we obtained orders from a company 
called Cogent. Cogent is an internet backbone company. They 
route all the traffic on the internet. We obtained records 
from them yesterday, which we produced with a business records 
certification, that they routed the traffic to Boston. 

THE COURT: You got it yesterday? 

MR. KOSTO: Well, when this became an issue, we 


reached out to this company, which we didn't know existed 


before, and they are a ginormous company -- 


THE COURT: You've got to give them enough time to 
respond. 

MR. KOSTO: They are responding. 

THE COURT: For them to respond. 

MR. KOSTO: Yes, and they've responded that they 
object to -- 


THE COURT: I understand, but it's just -- it's a lot 
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to come in the night before. This case has been pending for 
over a year. I don't know -- 


MR. FRANK: Judge, these are critical records -- 


THE COURT: I understand, but it came in last night at 
midnight. That's why we have discovery rules. 


I don't know what I'm going to rule, but I need to 


look at them. I've not seen them and the jury is outside. And 


let me look at it and let me look at the Facebook thing. And 


this is what's not supposed to happen at midnight the day of 


trial you're planning on introducing them. You may have to 
call this agent back if we can't figure it out. 

MR. NEMTSEV: Your Honor, can we show you just one 
exhibit we worked on last night? It's the Porsches. I worked 


on it all night. 


HE CLERK: I switched over to Tim. 


HE COURT: Why did you work on the Porsches all 


MR. FRANK: Your Honor, this is an issue that he's 


raising now that's been decided. 


I want to take two seconds to address an issue that's 


about to come up, which I think can be readily addressed, and 


that is, it's an authentic business record of a major United 


States company that routed internet traffic to Boston. The 


fact that that happened is indisputable, it's authentic. It 


has nothing to do -- 


Case 1:21-cr-10104-PBS Document 183 Filed 02/06/23 Page 25 of 176 


THE COURT: I understand. It's the issue -- I'm not 


denying it, I need to read it. I need to hear argument on it. 


It's 10 past 9 and the jury is standing outside. This is why 


we have rules of discovery so that we don't surprise the other 


Side. 


I may end up going with you, just like I did on 


business records when I understand it. You can't do it this 


way. 


So I'll deal with it either at the break. T'll have 


copies of the two sets of records. 
MR. NEMTSEV: Does that work for the Porsches? 


THE COURT: Do you like this picture of the Porsches? 


MR. FRANK: We do not stipulate to the picture of the 


Porsches. This is entirely misleading. Mr. Ermakov was the 


only employee out of a company of over 100 employees who got a 


car that matched the defendant's car that had matching plates. 
The fact that the cars match is not visible from this 


photograph. 


These are -- it is -- 
THE COURT: Well, let me see your version. 
MR. FRANK: Our version removes the logo from the car 


so it's not identifiable. 


THE COURT: Let me see it. 


(Pause.) 


MR. FRANK: We've removed the logos. 
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MR. FERNICH: Come on. 
(Laughing. ) 


MR. FRANK: Your Honor, I can't identify the make of 


that car. I can see that they match. 
MR. FERNICH: I can identify the make of the car. 


THE COURT: I don't know about cars, don't care about 


cars, but you can tell they're pretty fancy. 

MR. FRANK: But that's the point. That's the point, 
your Honor. 

THE COURT: I don't know. I don't have a serious 


don't like yours and I don't like yours. Can't we 


MR. FERNICH: How about a middle ground. 


MR. FRANK: Judge, we're sanitizing the relationship 


the defendant -- 


THE COURT: I'm sorry, when you say, You're talking to 


a girl, that's not sanitizing a relationship. 


MR. FERNICH: That's a bromance. 
THE COURT: That's a bromance. 


Let's bring this jury in. 


MR. FRANK: This is literally about to come up. 


THE COURT: I'm going to allow in the government's 


Can I have the pictures, please, that are -- not the 


picture, I'm sorry, the disputed exhibits I haven't ruled on. 
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(Discussion off the record.) 
MR. FRANK: Exhibits 9 and 11 I put in yesterday. I 


don't know that they were reflected. 


THE CLERK: I think they were. 


MR. FRANK: I just want to make sure. 
THE CLERK: Yes, I remember 9 and 11. I don't know 


I do. 


Is the agent here? 


MR. FRANK: Yes, he's right there. 
You can get up on the stand. 


THE CLERK: All rise for the jury. 


(Jury entered the courtroom.) 


THE COURT: Good morning. Sorry for the slight delay. 


We've been going through some issues in the trial. 


So anybody speak about the case or read anything in 
the press? 

I find the jury has complied. 

You've been terrific showing up on time, thank you. 

THE CLERK: Judge, can I just swear one of the 
interpreters in. 

(Interpreter sworn in by the clerk.) 

THE CLERK: Thank you. 

Sir, you're still under oath. 

THE WITNESS: Yes, ma'am. 


THE CLERK: You may all be seated. 
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MR. FRANK: May I, your Honor? 
THE COURT: Yes. Continue. 


MR. FRANK: Can all of the members of the jury see 


that exhibit? 


THE COURT: I would put it up. 


It is going to block me, but my experience in this 
courtroom, which is not ideally designed for this purpose, is 


to put it right there. And maybe you just walk it across so 


they can all see. 
MR. KOSTO: May I? 


THE COURT: Yes, please. 


This is what we quaintly call a chalk. In olden days 


we used blackboards, and when people would draw pictures -- 


this is to help you understand everybody's name because there 


were a lot of names that came at you yesterday. 
We put it up here, as you're mentioning someone and 
trying to figure out where it fits with the pictures, this 


might be helpful. 


So we're going to mark that as Exhibit -- not exhibit, 


for identification. 


THE CLERK: CCC. 


THE COURT: CCC. 


(Exhibit CCC marked for identification.) 


MR. FRANK: Thank you, Mr. Kosto. 


THE CLERK: CCC are the pictures. 
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DAVID HITCHCOCK, having been previously duly sworn by 


the Clerk, was further examined and testified as follows: 


CONTINUED DIRECT EXAMINATION 


BY MR. FRANK: 
Good morning, Special Agent. 
Good morning. 


Q. Just to orient the jury, since there were a lot of names 


that came at us yesterday, and -- can you see the chalk? 
A. Would it be helpful if I -- 


MR. FRANK: Could the special agent approach the 


THE COURT: I have to ask Debbie. 


t would be hard to hear -- perhaps what we can do is 


pick up that thing and just have him stand and hold it. 


My eyes might not be able to capture all that. 

MR. KOSTO: May I approach Special Agent Hitchcock? 

MR. FRANK: Mr. Kosto is playing the role of Vanna 
White today. 

MR. FERNICH: She's better looking. 

MR. KOSTO: Stipulated. 

Just to orient the jury 

THE COURT: And then it will come back over here. 


Because the reason is, the court reporter has to hear it 


through the mic in order to take it down, so -- 


BY MR. FRANK: 
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On the top left, who is that individual? 


The defendant, Vladislav Klyushin. 
O:. And we were in the midst of discussing some photographs of 


another individual that were found in the defendant's iCloud 


account and WhatsApp messages between Mr. Klyushin and another 
individual. Who is that individual? 

A. Ivan Ermakov in the red to the right of Mr. Klyushin in 
this chart. 

Os And then we discussed an employee list that we took a look 
at involved various M-13 employees. Do you recall that 
testimony? 


A. 


0. And do you recall that Mr. Klyushin was on that list, as 


was his wife? 
Yes. 
And Mr. Ermakov was on that list? 
Yes. 


And then there's a third individual to the right of 


Ermakov. 


Mr. Kosto, if you could just indicate Mr. Rumiantcev. 


Who is that individual? 


Nikolai Rumiantcev. 


And he was on that list? 


Yes. 


THE COURT: As you'll see, those are the three 
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named -- the allegations are against those three named alleged 
co-conspirators, so those are -- all right. 

So now move on to the next ones. 
BY MR. FRANK: 


oF We are about to discuss these individuals this morning, 


but we have not really discussed them yet, but could you 
identify by name the next two individuals? 

MR. FRANK: And, Mr. Kosto, if you wouldn't mind 
indicating. 
A. Igor Sladkov. 
OQ. And on the bottom left? 
A. Mikhail Irzak. 
0. At the exact moment that we broke yesterday, and we'll be 
resuming testimony about three individuals, who are those 


individuals? 


A. Starting with the individual on the left, Boris -- this is 


Alexander Borodaev. 


I'm sorry? 


Alexander Borodaev. 

Is that mislabeled on the chart? 

Yes. 

Oh, that's helpful. 
Okay. So that's Alexander Borodaev. 
THE COURT: What's it say on the chart? 


MR. KOSTO: Those two names are swapped. 
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THE COURT: Why don't you just do arrows so no one 


gets confused here. 


You've seen these pictures yesterday, but -- 
BY MR. FRANK: 
Okay. So that is, in fact, Alexander Borodaev? 


Yes, on left. 


And the next individual? 
Boris Varshavksiy. 


And the last individual? 


Sergey Uryadov. 


And how were those three individuals related to what we've 
talking about? 


Investors of Vladislav Klyushin. 


THE COURT: So they're not charged in any way. 


They're alleged investors, all right. 
(Discussion off the record.) 
BY MR. FRANK: 


Q. If we could pick up, you left off at Exhibit 152B. 


Again, a moment ago we were talking about 
Mr. Varshavksiy and Mr. Borodaev. 
Yes. 
Also known as Alexander Borodaev? 
Correct. 


So just to take us back to where we were, what is 152B? 


A group chat communication amongst Vladislav Klyushin, 
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Alexander Borodaev, and Boris Varshavksiy. 

On And again, those two individuals are -- 

A. Investors. 

Q. Okay. And what does Mr. Klyushin say? 

A. Good morning, I am back, had a good vacation, ready to 


work. Congratulations to Boris, he showed super result for the 


4-months period and made $632,000. Alexander's is a little 


worse, $461,000. Also, open broker created a new function and 


you could follow the value of your portfolio online, I will 


send you the log in password below, you could look at it at 


time. There will be no bids until April 15, so if you want 
can withdraw extra funds. 
And then there's a login and password for "bv"? 
Correct, for Boris Varshavksiy. 
And then a login and password for "ab"? 


For Alexander Borodaev. 


And a link to a website called openbroker.com? 


Correct. 


MR. FRANK: Ms. Lewis, you can take that down. 


And if we can now look at Exhibit 55 and 55A. 


Special Agent, on the left, Exhibit 55 -- 
MR. FRANK: And I offer this, Ms. Molloy. 
(Exhibit 55 received into evidence.) 
What is Exhibit 55? 


55 is a Russian language original version, it's a 
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screenshot of an email found in Vladislav Klyushin's Apple 
account. 
on And what is 55A? 

The FBI English translation. 

And who is the email from? 

nr@ml3.ru. 

Who is the email from? 

We identified this email account to belong to Nikolai 


Rumiantcev. 


Q. Could you read the text of the subject line of the email 


and the body of the email. 
A. Documenting profit at the end of 3rd quarter of 2020 for 
brokerage account of Alexander Borodaev (draft). 

Greetings, the company M-13 has finished 3rd quarter 
of 2020 and plans to record profits based on trade results. 
Details provided in the table. 

0. And what does it indicate as the investment? 


10,013,068 U.S. dollars. 


And the portfolio value as of September 17, 2020? 
11,324,505 U.S. dollars. 
And the profit? 


1,311,437 U.S. dollars. 


In the quarter, correct? 


Correct. 


And what does this email indicate the client receives 
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percentage-wise of that amount? 
Bey Forty percent, and an additional tax is included in what 
they received to cover their tax liability. 
Q. And the amount? 
A. 478,000 U.S. dollars. 
Q. And what does the email indicate Mr. Klyushin's company, 
M-13, receives of that amount? 
A. Sixty percent. 
oF And the amount? 
A. 522,000 U.S. dollars. 
MR. FRANK: Ms. Lewis, could we look at 56, and 56A, 
please. 
Q. What is Exhibit 56, Special Agent? 


A. This is another screenshot of an email that was identified 


and located in the Vladislav Klyushin Apple account. 


Q. And who -- 
MR. FRANK: The government offers 56 and 56A. 


(Exhibits 56 and 560A received into evidence.) 


BY MR. FRANK: 


QO. And who is this email from? 


This is from Nikolai Rumiantcev to Vladislav Klyushin. 


Subject? 
Regarding documenting profit at the end of 3rd of 2020 for 
brokerage account of Sergey Uryadov (draft). 


Okay. We can skip over the text that's on the screen. 
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What's the investment capital? 
5 million U.S. dollars. 


What's the portfolio value as of September 17, 2020? 


6,125,274 U.S. dollars. 


How much of that did the client receive according to this 
email? 
A. Forty percent plus tax, the tax liability. 

The amount? 

406,300 U.S. dollars. 

And how much was allocated to Mr. Klyushin's company? 

Sixty percent. 

The amount? 

443,700 U.S. dollars. 

MR. FRANK: Could we have 57 and 57A, please. 

O.. What is 57? 


A. A third screenshot of an email from Nikolai Rumiantcev to 


Vladislav Klyushin found in the Vladislav Klyushin's Apple 


account. 


Q. And, Special Agent, I note that the screenshot appears to 
be cut off on the right-hand side. Is that how it was found? 
A. Yes. 


Q. And if we could just -- if I could direct your attention 


to 5S7A. 
Who is the email from and to? 


Nikolai Rumiantcev to Vladislav Klyushin and two others. 
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What does it say? What's the subject line? 

Report on June to July 2020. 

What's the text? 

Greetings, I am sending over information on yesterday's 
trading, as well as a non-fixed profit for BURL for the end of 
past quarter. 

O-« And are you familiar with a company that has the stock 
symptom BURL? 

Yes. 

Is that Burlington Coat Factory? 

Yes. 


And directing your attention to the accounts listed below, 


can you just tell us what the accounts are identified as on 


this chart? 


Yes. Starting at the top, VK_SAXO. 


Whose initials are "VK"? 


Vladislav Klyushin. 


The next? 


AB Saxo. 

Whose initials are "AB"? 
Alexander Borodaev. 

The next? 

USS _ Saxo. 


Were you able to determine whose initials that corresponds 
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Sergey Uryadov. 

The next? 

NR. 

Whose initials are those? 


Nikolai Rumiantcev. 


The next? 

M-13. 

The next? 

VK5. 

And the next? 

VK_BCS. 

What is "BCS"? 

Broker Credit Services. 
That's a different brokerage firm? 
Correct. 

Thank you. 


MR. FRANK: You can take that down, Ms. Lewis. 


I believe I offered that, Ms. Molloy. 


THE CLERK: You did. 
(Exhibits 57 and 57A received into evidence.) 


MR. FRANK: I'd like to offer for identification only 


Exhibit 183, and then I'd like to offer from Exhibit 183 a 


couple of excerpts, 183A and 183B. 


Or. Special Agent, what is Exhibit 183A? 


A. This is a chat between Vladislav Klyushin and Boris 
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Varshavksiy. 
Q. So -- and Boris Varshavksiy, again, is one of those 
investors we just talked about? 
A. Yes. 

MR. FRANK: Ms. Lewis, just for a moment, if we could 
blow up as you were just trying to do, the text. 

If you could just go a little further so we could just 


see the dates. 


What is the date of this communication? 
August 27 of 2020. 


What does the first line indicate? 


image was sent. 


d what image was sent? 


e image on the right of the four vehicles was sent 


slav Klyushin to Boris Varshavksiy. 


That's 183B, that image? 
Yes. 


And what does Mr. Klyushin write? 


"Only you, the investor, is missed here." 
How does Mr. Varshavksiy respond? 

"Are all of these yours?" 

And how does Mr. Klyushin respond? 
"Uryadov, Ivan, and two that are mine." 
And what's on the next line? 


Tears of joy emoji. 
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That's from Mr. Varshavksiy? 
Correct... 


And then what does Mr. Klyushin write? 


"Stop by for a visit today. Delivered to all of us at the 
time." 
And how does Mr. Varshavksiy respond? 


"Beautiful." 


Q. Directing your attention to the line above the tears of 
joy emoji, who's Uryadov? 

A. Uryadov is Sergey Uryadov. 

Q. Who is Ivan? 

A. Ivan Ermakov. 


O\. So directing your attention to the Exhibit 183B on the 


left, which is the vehicle that the defendant attributes to 
Mr. Uryadov? 


A. The far left vehicle. 


Which is the vehicle that he attributes to Mr. Ermakov? 


The blue vehicle. 


MR. FERNICH: Objection. 
THE COURT: Well -- sustained. 
BY MR. FRANK: 


Ou Which is the vehicle he attributes to Ivan -- 


MR. FERNICH: Objection. 


THE COURT: Sustained. 


MR. FRANK: Directing your attention to the three 
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vehicles on the right, Ms. Lewis, could you enlarge the license 


plates? 


Q. Special Agent, what do those three license plates have in 


common? 
A. The number -- 
FERNICH: Objection. 


COURT: Overruled. 


WITNESS: May I finish. 


COURT: Yes. 


the name of the defendant's company? 


MR. FRANK: The car on the far left, Ms. Lewis, if you 


could enlarge its license plate. 


Does that car have the number 13 in its license plate? 


No. 
Thank you. 


MR. FRANK: Ms. Lewis, you can take this down. 


And I offer that, Ms. Molloy. 


(Exhibits 183A and 183B marked for identification.) 


MR. FRANK: Could we take a look at Exhibit 60A in 
evidence. 

THE COURT: Can we mark that for ID? 

I had an idea. We can haven't it at the break. 


MR. FRANK: Yes, your Honor. 
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BY MR. FRANK: 


Q. This is Exhibit 60A in evidence. We looked at it 
yesterday. 
A. 
O' From the defendant's company's website, can you read how 
many employees M-13 has? 
ie It employs a staff of more than 100 developers, linguists, 
media analysts and other experts. 
Q. Did you see any evidence in -- 

MR. NEMTSEV: Objection. 

THE COURT: I haven't heard the question yet. 
BY MR. FRANK: 
Oo. Did you see any evidence in the iCloud returns that you 
searched about other employees with cars matching the 
defendant's? 

MR. NEMTSEV: Objection. 

THE COURT: Overruled. 


A. Could you repeat the question, please? 


Q. Did you see any evidence in the iCloud returns that you 


searched of any other M-13 employees with cars that matched the 
defendant's? 

A. No. 

On Okay. Special Agent, I now want to return to some 


excerpts from the WhatsApp chat that we were looking at 


yesterday between the defendant and Mr. Ermakov. 
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MR. FRANK: Ms. Lewis, if you could call up Exhibit 


And I'd offer it. 


(Exhibit 151G received into evidence.) 


What is the date of 151G? 
June 12th of 2019. 
Can you read it for the record and identify the speakers, 


please? 


ladislav Klyushin: Hi. Did you watch the final episode 


lions? 
Ermakov: Hi, no, I stopped on the 6th. 
Klyushin: That episode is cool. 


Ermakov: I'll watch it. 


Klyushin: Kolya's stocks grew. 
d you see the last entry is at a different date and time 
e prior entries? 


June 13. 


And what is Kolya a nickname for? 
Nikolai. 


And whose name in this investigation is Nikolai? 


Nikolai Rumiantcev. 


And are you familiar with the American television show 


"Billions"? 


What is it about? 
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MR. FERNICH: Objection. 
THE COURT: Sustained. 


MR. FRANK: Could we look at Exhibit 1511. 


And I'd offer it. 


(Exhibit 1511 received into evidence.) 


BY MR. FRANK: 


Ox Special Agent, can you identify -- read the date of 


Exhibit 1511. 


A. February 9 of 2020. 


Q. And can you read the exchange and identify the speakers. 


The first line appears to be a website? 
Correct. 


And could you go on from there, please. 


Ermakov: This one -- strike that. 
Ermakov: This one. 


Klyushin: When do you want to collect it? 


Ermakov: It can be done either on Tuesday or on 


Wednesday. 


Klyushin: How about Thursday? If you need me I'm 
available on Thursday. In case you don't need me I can make 
organize a meeting with a realtor on either Tuesday or 


Wednesday. That, or as an option, to leave work at 13:00 on 


Wednesday, check a few properties and then head to sauna. 


Ermakov: Option for Wednesday sounds good. 


And that website that's transmitted above, does that 
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appear to be a real estate website? 
A. Correct. 

MR. NEMTSEV: Objection. 

THE COURT: You need to hold on a second when there's 
an objection. 

THE WITNESS: I apologize. 

THE COURT: Overruled. 


MR. FRANK: If we could call up Exhibit 151J, and I'd 


offer it. 


(Exhibit 151J received into evidence.) 


BY MR. FRANK: 


Q. Special Agent, taking a look at 15l1J, a continuation of 


the WhatsApp chat between the defendant and Mr. Ermakov, can 


you fell us the date? 
A. February 12, 2020. 


Q. Can you read this one for the record, please. 


A. Vladislav Klyushin: At this point I want nothing except 


the boat. This I want very much. 


Ermakov: Then you need nothing. Enjoy your life. 
You have everything. 
Klyushin: Thumbs up emoji. 


I am fucking tired rushing all the time. Need a rest. 


Ermakov: I've read somewhere that if you keep buying 


while you have everything, it means you're unhappy. And this 


is not about shares. 
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Klyushin: My pleasure is the boat and trading. 
Ermakov: Well, then, this is super. 


Klyushin: I am really enjoying it. But not ones from 


Ermakov: Well, this depends on timing. When it goes 
as predicted, then it is fine. It's not so much when it acts 
unpredictably. 

Klyushin: Honestly I get a bigger kick when I check 


apartments for you, with you, the fact that we can walk home 


together and have a beer, or play golf, or simply send everyone 


to hell, knowing that you are close. 
Ermakov: This truly sounds like a nice declaration of 
love, like a declaration of love to a girl. 


Klyushin: We spend a lot of time together, I feel 


good and calm, everyone does their job, does his own work. 


Smart asses like Sergei Mikolayevich make me mad. Here, we 


work quietly and do not bother anybody. We will learn how to 


have a great time, we'll ban talks about work and everything 


will being outstanding. 


Ermakov: I agree, restrictions are important. 


Q. Special Agent, the first line of this exchange references 
a boat. Do you see that? 

A. 

OQ. Did you see photos of a boat exchanged between 


Mr. Klyushin and Mr. Ermakov? 
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Yes. 

And was that in the days after this exchange? 

Yes. 

Was there one photo of a boat or were there multiple 
photos? 
A. There were 29 photos. 

MR. FERNICH: Objection. 
COURT: Sustained. 


MR. FERNICH: Move to strike. 


THE COURT: Yes. 

BY MR. FRANK: 

oF Was there more than one photo? 
MR. FERNICH: Objection. 
THE COURT: Overruled. 


Yes. 


Showing you now Exhibit 19. What is Exhibit 19? 
A picture of a boat. 
MR. FRANK: The government offers 19. 
THE COURT: Allowed. 
(Exhibit 19 received into evidence.) 


BY MR. FRANK: 


Was this one of the photographs that was transmitted? 


Yes. 
By whom? 


Vladislav Klyushin to Ivan Ermakov. 
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Q. Did you find any of the boat images that Mr. Klyushin 
transmitted to Mr. Ermakov anywhere else? 

Yes. 

Where? 

Mr. Sladkov's, Igor Sladkov's Apple account. 


We're going to get to Mr. Sladkov in a minute, but is he 


the individual that was referenced earlier in the top right of 


that poster board? 
A. 
OQ. And did you find one image of the boat in Mr. Sladkov's 
iCloud account or more than one image? 
A. Twenty-nine. 
MR. FERNICH: Objection. 
THE COURT: You know, I strike that. 
So there was more than one picture of the boat. 
That's all that's in evidence. 
BY MR. FRANK: 


Ow Were you able to determine how those photos of the boat 


were transmitted to Mr. Sladkov? 
A. WhatsApp. 
Q. Were you able to determine by whom? 
A. Ivan Ermakov -- 
MR. FERNICH: Objection to these questions. The 
answers are not responsive to the question. 


MR. FRANK: The question was by whom. 
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THE COURT: Ask the question again, please. 


MR. FERNICH: Could the court reporter just read the 


questions back, please? 
(Record read.) 
THE COURT: I'll allow that. 
Go ahead. 
MR. FRANK: Thank you. 
BY MR. FRANK: 
Q. Were you able to see the substance of the associated 


messages between Mr. Ermakov and Mr. Sladkov? 


Why not? 
That content was not identified or located. 


MR. FRANK: Could we go back to Exhibit 151 and look 


at the excerpt 151L, please. 


QO. What is the date of Exhibit 151L? 


A. February 21, 2020. 


Q. Could you read this exchange for the record, please. 


A. Klyushin: Let me help you with Saxo, if you need it, 


otherwise I have nothing to do. 
Ermakov: I'll do it myself. 
Klyushin: Okay. 
Ermakov: Thank you. 
And what is Saxo? 


Saxo is an online brokerage firm. 
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MR. FRANK: Could we look at Exhibit 151M, please. 


Special Agent, what is 151M? 
is is an -- a reference to a document that was passed 


Vladislav Klyushin and Ivan Ermakov. 


at is the date? 


e date is March 3, 2020. 


MR. FRANK: I offer 151L and M. 


(Exhibits 151L and 151M received into evidence.) 
BY MR. FRANK: 
Q. And were you able to locate this document? 
A. 
MR. FRANK: Could we have on the left 264 and on the 
right 264A. 
And I offer them. 
(Exhibits 264 and 264A received into evidence.) 


What is Exhibit 264? 


264 is a Russian language version of a loan agreement. 


And what is 264A? 


The FBI translation of the loan agreement. 

Okay. And what is the date of the loan agreement? 
March 3, 2020. 

Could you read the first paragraph, please? 


Citizen of the Russian federation Yermakov, Ivan 


Sergeyevich, further referred to as the borrower, the party 


one, and citizen of the Russian federation Klyushin, Vladislav 
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Dmitrievich, further referred to as the lender, the party two, 


collectively be known herein as the parties and separately as 


the party, made an agreement (further referred to as the 


agreement, with the following terms. 


Q. And directing your attention to the first provision of the 


agreement, what does it say, 1.1? 
A. The lender agrees to give the borrower the loan as per 
borrower's written request, and the borrower agrees to repay 


the principal amount of the loan, together with the interest on 


the amount of the loan in accordance with the terms and 
conditions set forth in the agreement. 
Q. And what does 1.2 indicate? 
MR. FRANK: Ms. Lewis, you can just enlarge 1.2 
through 1.6. 
Thank you. 
at does 1.2 indicate? 


e loan amount is 100 million rubles. 


d what is 100 million rubles at this time in March of 


dollars? 


MR. FERNICH: Objection. 


Approximately -- 


THE COURT: You know, when there's an objection -- I'm 
not an ATM machine, I just need to think one second. 
THE WITNESS: I apologize, Judge. 


THE COURT: The question is: Do you know how much in 
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dollars that is at this point? 
THE WITNESS: Yes, ma'am. 
THE COURT: I'll allow the answer. 
Go ahead. 
A. Approximately one-and-a-half millions U.S. dollars at the 
time of this exchange. 
Ox Thank you. 


.3, Special Agent. 


A. The lender shall make the payment of the loan amount to 
the borrower within five business days from the moment of 
receiving the borrower's written request. 
Q. Special Agent -- 

MR. FRANK: Ms. Lewis, if we could go to the last page 
of these two exhibits. 

MR. FERNICH: Judge, we're going to request a limiting 
instruction on this material, and we can discuss it at sidebar, 
if that's better for your Honor; whatever the Court wants. 


THE COURT: I don't know what it is. 


MR. FERNICH: The material that just came in. That's 


ongoing right now. We can do this at 11:00, if your Honor 
prefers. 
THE COURT: We'll do it later, all right. 


BY MR. FRANK: 


on Special Agent, do you see that there are signatures on the 


left? 
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Ons And indicating on the translation on the right, whose 
Signatures are those? 


A. Ivan Ermakov and Vladislav Klyushin. 


MR. FRANK: Thank you. You can take that down, 


Lewis. 


Could we have excerpt 151N, please. 
Special Agent, what is the date of this exchange? 
June 30, 2020. 
Could you read it for the record. 
Klyushin: The apartment is cool. 


Ermakov: Winking smiley face emoji. 


Klyushin: We will earn the money and then we can buy. 


Ermakov: Then I better get to work. 


Klyushin: No need to, just turn the computer on and 
think a little bit. 

Ermakov: I already gave it a thought yesterday. I 
will be thinking more today. 

Klyushin: Four crying tears of joy emoji. 

MR. FRANK: Could we have 1510, please. 
Q. What is 1510? 
A. Another exchange on August 17, 2020 between Ivan Ermakov 


and Vladislav Klyushin. 


MR. FRANK: The government offers N and 0, 151N and 0. 


(Exhibits 151N and 1510 received into evidence.) 
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Ors Could you read this for the record, please. 


A. Ermakov: Signed everything, need to pay for it. I will 
ask Tatayana to send you. 


Klyushin: I congratulate you. Tatayana will send you 


scans of all the documents and we will pay. They won't pass 


anything without documentation. 
Ermakov: I will send them to you later. I have them. 


Klyushin: I've got it, but it can wait until 


tomorrow, isn't it? 


Ermakov: Thank you very much, yes, we have three 


Klyushin: This is a good apartment. Good job. 
Ermakov: I concur. And the judge is very nice. I 


would even classify it as a pretty one. 


Klyushin: This is great. Were you acting in 


Klyushin's role? I am happy for you, you got the apartment you 


need. No matter how many kids you'll have, this one is comfy 


to live in. 


Ermakov: No. I was in my role. 
Klyushin: Suits you perfectly. 
Ermakov: In addendum it say I am the signer and you 
are the owner. It will be destroyed on the of signing. 
Klyushin: Got it. 
Thank you, Special Agent. 


MR. FRANK: You can take this down, Ms. Lewis. 
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Q. Yesterday we looked at a series of photos that were found 


in Mr. Klyushin's iCloud account. Do you recall that 
testimony? 
A. Yes. 
Os I'd like to show you one more photo. 
MR. FRANK: Could we have Exhibit 34, please. 
And I offer it. 
(Exhibit 34 received into evidence.) 
ere was this photo found? 
Klyushin's Apple account. 


d do you recall the date of this photograph or the date 


th? 
Was this from the summer of 2020? 
MR. NEMTSEV: Objection. 
THE COURT: Overruled. 


Do you know? 


THE WITNESS: Yes. 


THE COURT: Do you remember yourself? 


THE WITNESS: Yes, I reviewed these documents. 


Yes, it was from the summer of 2020. 


And what is depicted in the plastic sleeve on the table? 


A. Inside the document protector is an article, a hard copy 


of an article inside the document protector. 
THE COURT: Make it clear, this has nothing to do with 


Mr. Klyushin or anyone else mentioned in terms of this person 
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who allegedly was the Ukrainian hacker. 
So this has nothing to do with the current case. 
BY MR. FRANK: 
Q. And this photograph that you found in the defendant's 
iCloud account, this article in the plastic sleeve, can you 
read the headline of the article? 
As "Ukrainian Hacker Gets Prison in U.S. Insider Trading 
Case." 
Os Were you able to locate this article? 
A. 
MR. FRANK: Ms. Lewis, if you could put Exhibit 150 on 
right, please -- and I'd offer 150. 
(Exhibit 150 received into evidence.) 
What is 150? 
This is the article that was depicted in the photograph. 
Q. And could you just read the first paragraph of the 
article? 


A. A Ukrainian computer hacker was sentenced on Monday to 


2 1/2 years in prison over his role in a global scheme to 


conduct insider trading based on stolen, yet-to-be-published 


corporate news releases, U.S. prosecutors said." 


Q. This article about the hacker and the insider trading 


scheme on stolen news releases, this was found in 


Mr. Klyushin's iCloud account that's dated from the summer of 


2020? 
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MR. FRANK: Ms. Lewis, if you could enlarge the top, 
very top date on the article. 
Q. What was the date that this article in the plastic sleeve 
was published? 
A. May 22, 2017. 


Q. How long is that before the date of the photograph? 


MR. FERNICH: Objection. 
BY MR. FRANK: 
Q. With the article in it? 
MR. FERNICH: Objection. 
THE COURT: Excuse me, objection to -- 


MR. FERNICH: Speaks for itself. 


THE COURT: That's the date. 


BY MR. FRANK: 


Q. What is the gap between the date of the article and the 
of the photograph of the article? 
MR. FERNICH: Yes, objection. 
THE COURT: Overruled. 


This is three years later. 


sorry, Special Agent. The article is May 22, 


the photograph was August of 2018? 
sorry -- 


THE COURT: All right -- 
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MR. FRANK: Now I'm confused. 


Ay It was the summer -- the photograph with the document 


protector is the summer of 2018. The article is from May of 


2017. It was August versus May, so it's a year and several 
months, a year and a few months later. 


Q. I apologize, I confused that, Special Agent. 


THE COURT: Well -- 
BY MR. FRANK: 
On Special Agent, I now want to ask you some questions -- 
MR. FRANK: And Ms. Lewis, you can take that down. 
Q. I now want to ask you some questions about connections 


between Mr. Sladkov, the individual on the top right of the 


poster board; Mr. Ermakov; Mr. Klyushin, and M-13. Okay? 


you have those individuals in mind? 


A. Yes. 


MR. FRANK: Ms. Lewis, if we could call up Exhibit 


in evidence. 


Special Agent, remind us again, what is Exhibit 3? 


This is a photograph of Ivan Ermakov's passport. 


Do 


a 


We looked at this photograph yesterday. But now I would 


to ask you, where was this photograph found? 


The Apple account of Igor Sladkov. 


Did you find other photos of Mr. Ermakov in Mr. Sladkov's 


iCloud account? 


A. Yes. 
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MR. FRANK: Could we have Exhibit 129, please. 


And I offer it. 
(Exhibit 129 received into evidence.) 


BY MR. FRANK: 


O's What is Exhibit 129? 
A. This is a photograph of Ivan Ermakov at a restaurant. 
And where was this found? 
Igor Sladkov's Apple account. 
Sitting here today, do you recall the year that this 
photograph was taken? 
Yes. 
What was the year? 
2016. 
MR. FRANK: Could we see Exhibit 266. 
And I'd offer it. 
(Exhibit 266 received into evidence.) 


QO. What is Exhibit 266? 


As This is a photograph that was located within Igor 


Sladkov's Apple account. 
Q. Who is it? 
A. Ivan Ermakov. 


MR. FRANK: Ms. Lewis, could you put up Exhibit 119 in 


evidence side by side. 
Q. Yesterday we looked at Exhibit 119. Do you recall that, 


Special Agent? 
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YES. 
Where was Exhibit 119 on the right found? 


Vladislav Klyushin's Apple account. 


And 266 was in Mr. Sladkov's iCloud account? 
Yes. 


Were you able to determine when these photographs were 


taken? 
Yes. On the birthday of Ivan Ermakov. 
Both photographs? 
Yes. 
On the same day? 
Ves. 
Other than these photographs that you found in 


ladkov's iCloud account and the photograph of 


lyushin's yacht, did you see any direct communications 


between Mr. Sladkov and Mr. Klyushin? 


MR. FRANK: Could we take a look at Exhibit 16, 


And I'd offer it. 
(Exhibit 16 received into evidence.) 


Q. What is Exhibit 16, Special Agent? 


A. This is a directory listing of folders and certain files 
provided by Apple regarding the Apple account for Vladislav 


Klyushin. 
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Ors And what does this directory listing from Mr. Klyushin's 
iCloud account depict? 

A. That there is a folder named app domain-su.m13.chat. 

Q. And what is app domain-su.m13.chat? 


A. Folders with this naming convention refer to an 


application on an Apple device, and this indicates that there 
was an ml3.chat application. 


Q. On Mr. Klyushin's iCloud account? 


A. 
Q. Did you find an ml3.chat application on any other iCloud 
accounts? 

VES 

Whose? 


Nikolai Rumiantcev and Igor Sladkov. 


Showing you Exhibit 15, what is Exhibit 15? 


A. This is a screenshot of the directory listing and certain 


files found within the Apple account of Nikolai Rumiantcev as 


provided by Apple. 


Q. And what does it indicate about that ml13.chat app? 


A. That it was also installed on a device that was associated 


with Nikolai Rumiantcev's Apple account. 


MR. FRANK: And I'd offer Exhibit 15. 
And now I'd offer Exhibit 14. 
(Exhibits 15 and 14 received into evidence.) 


What is Exhibit 14? 
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A. A similar screenshot of a directory listing of certain 
files for -- for Igor Sladkov's Apple account. 


O'. Okay. And what does this directory listing indicate? 


A. That there was also an ml3.chat app installed on a device 


associated with the Sladkov Apple account. 
Q. Were you able to review any communications over the 
ml3.chat application? 
A. No. 
Q. Why not? 
MR. NEMTSEV: Objection. 
THE COURT: Overruled. 


A. No communications were located. 


O.. Did you locate any graphical depictions of the m13.chat 


app on any of these iCloud accounts? 
A. Yes. 

MR. FRANK: Could we look at 136 and 137 side by side, 
please. 


Q. Were these two of the graphical depictions that you 


located on those iCloud accounts? 
A. Yes. 
MR. FRANK: I offer them. 
(Exhibits 136 and 137 received into evidence.) 
What do they depict for the record? 
Two chat bubbles with a lock. 


What does that indicate to you? 
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MR. FERNICH: Objection. 

THE COURT: Do you know? 

THE WITNESS: In my experience -- 

THE COURT: Do you know what this logo means? Have 
you seen it before? 

THE WITNESS: Only within the context of this 
investigation. 

THE COURT: Sustained. The objection is sustained. 

MR. FRANK: You can take that down, Ms. Lewis. 
Q. Special Agent, I'd now like to show you Exhibit 155 and 
155A side by side, and I'd offer them. 

(Exhibits 155 and 155A received into evidence.) 


QO. What is Exhibit 155? 


Aw 155 is the Russian language version of a product marketing 


slide deck, is the best description. 
Okay. And what is 155A? 
An FBI translation of that slide deck. 


Q. And just for the record, can you read what it says on the 


cover here? 
A. LAVR, "LAVR analysis system for large volumes of data and 
relationships therein." 

MR. FRANK: And if we could go, Ms. Lewis, to page 26 
of that document. 
Q. And could you read the email address at the bottom? 


A. lavr@m13.su. 
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Where was this document concerning the LAVR product found? 
Igor Sladkov's Apple account. 
O's Sitting here today, do you recall the date that it was 
saved to Mr. Sladkov's iCloud account? 
do. 
What is it? 
That was September 4th of 2019. 
MR. FRANK: Ms. Lewis, if you could leave Exhibit 15 
on the left and put up Exhibit 148 on the right. 
And I'd offer 148. 
(Exhibit 148 received into evidence.) 


What is Exhibit 148? 


This is a screenshot of the M-13 Facebook account. 

And what is the date of the screen -- of the paragraph 
that's depicted on the M-13 Facebook page? 
A. October 28, 2020. 
QO. And is that the Facebook translation of the Russian at the 


bottom of the screen? 


A. Yes. 
oF Could you read the first sentence of the English 
translation? 


A. Tomorrow our IT team will speak at the IDC security 


digital forum 2020 to present M-13's new product, the LAVR 


analytics platform. 


OF And could you read the second paragraph. 
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A. LAVR enables users to combine, structure, and analyze 
large quantities of data, as well as allocate links to 
previously uploaded information. LAVR helps investigate 
sensitive information leaks, detect malicious attacks on your 
corporate network, manage vulnerabilities and conduct pentest 
or redteam campaigns. 
Ox Approximately how long before the product was publicly 
announced was that document found on -- was that document saved 
to Mr. Sladkov's account? 
As Over a year and one month. 

MR. FRANK: If we could look at -- 

MR. FERNICH: Object to that. Foundation. I don't 
recall testimony that this document was saved to the Sladkov 
iCloud account. I could be wrong. 


MR. FRANK: He just testified to that. 


THE COURT: Do you remember that for sure? 


THE WITNESS: Moments ago I testified to the LAVR 


slide deck on the left -- I can't see the Exhibit Number -- 


MR. FRANK: 155. 
THE WITNESS: September 4th of 2019, this file appears 


in Igor Sladkov's account. And one year and one month anda 


little bit longer later, this M-13 Facebook post appears on the 


internet. 
MR. FERNICH: Okay. 


THE COURT: All right. 
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BY MR. FRANK: 
Q. Thank you, Special Agent. 

Did you see any images shared between Ivan Ermakov and 
Igor Sladkov regarding securities trading? 
A. Yes. 

MR. FRANK: Could we have Exhibit 133, please. 

And I'd offer it. 

(Exhibit 133 received into evidence.) 


Q. What is Exhibit 133? 


A. This is trading for the KSS ticker symbol, which refers to 
Kohl's. 


Kohl's the department store? 


Q. What is the -- do you recall sitting here today the date 
of this screenshot? 


A. This is in May -- do you have anything that would refresh 


my recollection of the year? 


0. Sure. 


MR. FRANK: For identification only, could we show the 


witness 133A, please. 
OQ. Does this refresh your recollection on the date that this 


exhibit was shared between Mr. Ermakov and Mr. Sladkov? 


What was the date? 


May 21, 2019. 
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Q. Okay. And so this exhibit from May 21 -- if we could go 


back to 133, this depicts trading in which security? 


A. Kohl's. KSS is the ticker symbol. 
MR. FRANK: If we could leave 133 up on the left and 
look at 265 on the right. 
And I'd offer 265. 
(Exhibit 265 received into evidence.) 
Os What is 265? 
A. 265 is the first page of an OTK or OTkritie brokerage 


account in the name of Vladislav Klyushin. 


MR. FRANK: I'd like to now -- Ms. Lewis, can you just 


highlight Mr. Klyushin's name on that document. 


oF I'd like to now show you an excerpt from these brokerage 


records, 265A on the right. 
And I'd offer it. 
(Exhibit 265A received into evidence.) 
Special Agent, do you see Exhibit 265A? 


I do. 


And what is 265A depicting? 


This is trading in the Kohl's name. 


Okay. And what is the date of the initial trade in Kohl's 
and all of the trades on this page? 
A. May 20, 2019. 
Q. So that's the day before that screenshot was sent? 


A. 
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And if we could look at the next page. 
Do you see there's additional trades on May 20th? 
A. Yes. 


Q. Okay. And then do you see there's a series of trades in 


the opposite direction starting on the following day, May 21st? 
A. 
Ox And that continues -- 

MR. FRANK: Ms. Lewis if you could show us. 

THE COURT: What do you mean in the opposite 
direction? 
BY MR. FRANK: 
OF Special Agent, can you explain? 


A. Yes. Whenever whatever an individual shorts a stock, 


then -- then the reference to the opposite direction is the 


ther side of the transaction. Sold them short and then the 


ther side of the transaction. 


Bought them back the next day? 


Bought them back the next day. 


So on May 20th, Mr. Klyushin sold shares of Kohl's? 


VE Sk 

And on May 21st, he bought shares of Kohl's? 

Correct. 

And what had happened to the price of Kohl's stock in 


between the time he sold it and when he bought it back? 


A. It had gone down. 
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And that leads to what? 
A profit. It's a -- if I could add -- 
MR. NEMTSEV: Objection. No question pending. 
BY MR. FRANK: 
Q. What were you going to say, Special Agent? 
A. It's a bet, you're placing -- 
MR. NEMTSEV: Objection. 
THE COURT: What are you explaining right now, what 
selling short means? 


THE WITNESS: To follow on to your question, Judge. 


THE COURT: What does selling short mean? 


THE WITNESS: You're placing a bet that the certain 


share price of a company will go down. 


MR. NEMTSEV: And I object, your Honor. He's not an 
expert witness. 

THE COURT: Overruled. 
BY MR. FRANK: 
Q. Did you also find references to Mr. Sladkov in 


Ermakov's iCloud account? 


Os As a general matter, did you find the content of any 
communications in Mr. Ermakov's iCloud account? 
A. No, sir. 


Q. Showing you 171 and 171A -- 


MR. FRANK: And I'd offer them. 
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(Exhibits 171 and 171A received into evidence.) 


MR. FRANK: And I'm not sure, Ms. Molloy, if I offered 
those last exhibits. 
133, 265, and 265A; and now I'm offering 171 and 171A. 
THE CLERK: Thank you. 
BY MR. FRANK: 
Ox Special Agent, what is 171? 


A. You'll see that this is a Russian version of a -- the 


Cyrillic representation of a name and associated contact found 


within the Apple account. 


And on the right, 171A? 


An FBI translation of the name portion only. 
Okay. 


THE COURT: "Cyrillic" means what? 


THE WITNESS: It's the character set that is 
associated with -- of one -- the Russian language. 
THE COURT: It's the alphabet for the Russian 


language. 


THE WITNESS: Yes, Judge. 
BY MR. FRANK: 
Q. Whose contact card is this in Mr. Ermakov's iCloud 
account? 
A. Igor Sladkov. 


Q. Do you see it lists his birthday? 


A. December 30, 1978. 
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Q. And directing your attention to the bottom of the screen, 


can you tell us what date this indicates the contact card was 
created? 
A. November 16, 2016. 

MR. FRANK: Thank you. 

Ms. Lewis, you can take that down. 
Ox As part of your investigation, Special Agent, did there 
come a time when you obtained what's called a pen registration 
and trap and trace device on a WhatsApp account used by Igor 
Sladkov? 
A. 
Q. Can you tell the jury what a pen register and a trap and 
trace is? 


As It is a court order signed by a federal judge allowing for 


the equivalent of caller ID on a WhatsApp account, so who is 


communicating with you. 
O.. Can you actually see content with a pen register? 


A. No. 


Ow What, if anything, did the pen register and trap and trace 


device show about contacts between Mr. Ermakov and Mr. Sladkov 
by WhatsApp? 

A. Could you repeat the question? 

On What did it show about contacts, if anything, between 
Sladkov and Ermakov? 


A. That they were in communication. 
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Okay. And did that include texts? 
Yes. 


Did it include images? 


Lt, eid. 
Did it include documents? 
Yes. 
Okay. And do you recall the date that you had that up? 
I do not. 
Did you review any other images concerning securities 
trading from Mr. Sladkov's iCloud account? 
A. 
Q. 
MR. FRANK: Can we start with Exhibit 30. 
And I'd offer it. 
(Exhibit 30 received into evidence.) 


Q. Special Agent, what is Exhibit 30 in evidence? 


A. This is a picture that appears to be a selfie of Igor 


Sladkov with Mikhail Irzak in the background. 


Mr. Sladkov is facing the camera? 

VES. 

Mr. Irzak is facing the computer screen? 

Yes. 

And this photo was found in Mr. Sladkov's iCloud account? 
Yes. 


MR. FRANK: Ms. Lewis, can you please enlarge the 
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laptop computer that is over Mr. Sladkov's shoulder. 
Q. Special Agent, do you see something covering the lens of 


the laptop computer? 


What is it? 
That is either a Band-Aid or a sticker that bears the 


distinct logo of the Russian Olympic Committee. 


MR. FRANK: Could we leave this up on the left and 
take a look at Exhibit 24. 
And I'd offer it. 


(Exhibit 24 received into evidence.) 


O. What is Exhibit 24? 

A. This is a screenshot or -- a screenshot of that same 
laptop that was found within the Apple account of Igor Sladkov. 
Q. And how do you know that this screenshot is from the same 


laptop? 


A. The very distinctive Band-Aid or sticker covering the 


camera of the laptop. 


MR. FRANK: And, Ms. Lewis, if you could take down 30 
and move Exhibit 24 to the left. We're going to test your 
Dexterity on the Trial Director. 

Q. And Special Agent, do you recall when sitting here -- off 
the top of your head, do you recall the date and time of this 
image? 


A. No. Do you have something that would -- 
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MR. FRANK: Could we have, for identification only, 


Exhibit 24A, please. 


O's Does that refresh your recollection about the date and 


that this image was taken? 
Yes, it does. 
What was the date and time? 
February 6, 2018 at 8:13 a.m. eastern time. 
MR. FRANK: And, Ms. Lewis, if you could just 
highlight that in the middle there. 
Exactly. 
February 6, 2018 at 8:13 a.m. eastern time? 
Correct. 
MR. FRANK: If we could go back to Exhibit 24. 


Q. Were you able to locate the document that is depicted on 


the screen of Mr. Sladkov's computer in Exhibit 24? 


A. 


MR. FRANK: Ms. Lewis, can you call up Exhibit 81, 


And I'd offer it. 


(Exhibit 81 received into evidence.) 


BY MR. FRANK: 


Q. Special Agent, what is Exhibit 81? 


A. This is a filing, it is a screenshot of the filing in the 


EDGAR database. 


QO» This is a document that was filed with the SEC? 
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Yes. 

Do you see at the top right it says Exhibit 99-1? 

Yes. 

Could you read the headline of the document? 

MR. FRANK: Ms. Lewis, if you could highlight that. 

Q. What does that say? 
A. "Snap Inc. reports fourth quarter and full year of 2017 
results." 
Os And what does the first sentence -- what is the date and 
the first sentence? 
A. The date February 6, 2018. Snap Inc. New York Stock 
Exchange SNAP ticker today announce financial results for the 


quarter and full year ended December 31, 2017. 


Q. And SNAP, is that the company behind Snapchat? 
A. Yes. 
MR. FRANK: Ms. Lewis, could you please highlight the 


operational highlights and just a little bit above that, the 


paragraph 2 above that, all the way to the bottom. And enlarge 


those, please. 
Q. Special Agent, I'd like to compare these documents. 


Do you see the first bullet point under "Operational 


Highlights" on the screenshot on Mr. Sladkov's computer? 


ld you read that bullet? 


ily active users. Daily active users (DAU) increased 


Case 1:21-cr-10104-PBS Document 183 Filed 02/06/23 Page 76 of 176 


8.9 million or 5% sequentially to 187 million, representing the 


highest net adds since Q3 2016. DAUS increased 28.8 million or 


18% year over year. 


Q. Do you see the same text in the document that was filed in 


the document with the Securities and Exchange Commission? 


On the right? 


O's Could you read the first few words of the second bullet on 


the left? 


A. Revenue was $285.7 million in 04 2017. 


Q. Do you see that same text in the second bullet in the 


document on the right? 


Do the other bullets also appear identical to you? 


oF Were you able to determine when the SNAP 8K was actually 


filed with the SEC over the EDGAR system? 


A. Yes. 
MR. FRANK: Could we look -- Ms. Lewis, if you could 


take down the exhibit on the right, and if we could look at 


Exhibit 249A on the right. 


Q. What is Exhibit 249A? 


A. This is a screenshot of the SEC filing to include date 


information for the 8K we were looking at, the 99-1 moments 
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Q. A moment ago you testified, Special Agent, that the 
screenshot from Mr. Sladkov's computer was taken on February 6, 
2018 at 8:13 a.m. eastern time. Do you recall that testimony? 
A. Yes. 

Q. When was the document filed with the SEC, according to the 
EDGAR system? 

A. 4:20 p.m. that same day, eastern. 

Q. How many hours was that after it appeared on Mr. Sladkov's 
computer screen? 


A. Bight. 


MR. FRANK: Could we look at Exhibit 26, please. 


Ol. Special Agent, what is Exhibit 26? 


A. This is another screenshot that was located within the 
Sladkov Apple account. 

MR. FRANK: I offer, to the extent I didn't, I 
apologize, Ms. Molloy, I offer Exhibits 24, 30, 81, and now 


249 -- I'm sorry, 249A and now 26. 


(Exhibits 24, 30, 81, 249 received into evidence.) 
THE CLERK: Thank you. 
BY MR. FRANK: 
Q. This was found -- another screenshot found in 


Sladkov's iCloud account? 


And sitting here today, do you recall the date and time of 
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this photo? 
Or would you like to look at some metadata. 
Metadata, please. 


MR. FRANK: Could we have, for identification only, 


Exhibit 26A. 
Does this refresh your recollection about the date and 
of this image? 
Yes. 
And what is it in eastern time? 
October 31, 2018 at 2:42 p.m. eastern. 


Were you able to locate -- if we could go back to 26 -- 


the document depicted on Mr. Sladkov's screen? 


A. 


FRANK: Could we have on the right Exhibit 82, 


Exhibit 82? 


the 99-1 exhibit associated with SSNC. 


FRANK: And I offer 82. 


(Exhibit 82 received into evidence.) 
THE COURT: All right. 
BY MR. FRANK: 
Q. What is the headline on this 99-1? 
A. SS&C Technologies reports 93 2018 results. 
Q. What is the date of the document? 


A. October 31, 2018. 
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Q. Would you read the first sentence, please. 
A. SS&C Technologies Holdings, Inc., NASDAQ ticker SSCN, a 


global provider of investment and financial software-enabled 


services and software, today announced its financial results 


for the third quarter ended September 30, 2018. 
MR. FRANK: Ms. Lewis, could you take us, please, to 


page 3 of the 8K, the 99-1. 


Q. Special Agent, do you see that there's a table there under 
"Guidance"? 
A. I. do:. 
Ox Okay. Could you -- if we look at the -- 

MR. FRANK: Ms. Lewis, could you enlarge that so we 
could see that as well. 

Thank you. 
Q. If you look at the image on Mr. Sladkov's computer screen, 
what does it indicate adjusted revenue will be for the fourth 
quarter of 2018? 


A. 1,075-1,085. 


Q. Does that indicate it's in millions? 


A. 

O. Do you see what's in the actual 99-1 that was filed with 
the SEC? 

A. Identical. 


Q. What about adjusted net income in millions in the document 


on Mr. Sladkov's screen? 
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210 to 220. 


What about the document that was filed with the SEC? 


A. Same. 


Ox Were you able to determine, Special Agent, when the actual 


8K was filed with the Securities and Exchange Commission? 


A. Yes. 


MR. FRANK: Ms. Lewis, if you could take down the 


enlargements, leave up Exhibit 26 on the left. And now on the 


right, if we could call up Exhibit 2491. 


And I'd offer it. 


(Exhibit 2491 received into evidence.) 


What is Exhibit 2491? 


This is a screenshot of the 8K that was filed on October 


2018 at 4:13 p.m. 


O.. I believe you said it's a screenshot of the 8K. Do you 


mean it's a screenshot of the EDGAR indicating when the 8K was 


filed? 


And when was that date and time? 


October 31, 2018 at 4:13 p.m. 


I believe you testified a moment ago the screenshot is 


October 31 at 2:42 p.m.? 


A. Correct. 


MR. FRANK: Ms. Lewis, you could take that down. 


And I'd like to show Exhibit 262. 
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And I'd offer it. 


(Exhibit 262 received into evidence.) 


THE COURT: How many more of these do you have? 
MR. FRANK: This is the last set of these, your Honor. 
THE COURT: Okay. And then we'll stand up and 
stretch, because this is a lot. 
Okay, thank you. 
BY MR. FRANK: 


Q. What is Exhibit 262? 


A. This is a screenshot found within the Olga Opukhovskaya 
Apple account. 

Q. Remind us, I believe you testified yesterday about who 
Olga Opukhovskaya is. 

A. individual that lives with Igor Sladkov and shares 
children with Igor Sladkov. 

Q. could you read the heading of this document that's 
depicted on the screen. 


"Entry Into a Material Definitive Agreement." 


And the first sentence. 


On October 18, 2017, certain subsidiaries of Tesla, Inc. 


at are respectively parties to an amended and restated loan 


d security agreement (the A and R 2016 warehouse agreement) 


da loan and security agreement (the 2017 warehouse agreement 


d together with the A and R 2016 warehouse agreement, the 


warehouse agreements) each dated August 17, 2017 with Deutsche 
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Bank AG, New York branch as administrative agent and the other 


parties named therein, entered into an amendment to each of the 


warehouse agreements. 


Q. Special Agent, what does the screenshot indicate was the 
date that this photograph was taken? 
A. On the bottom of the screenshot it's October 19, 2017. 
On Were you able to find this filing on the SEC's website? 
A. 

MR. FRANK: Ms. Lewis, if we could call up on the 
right, 261. 

And I'd offer it. 

If I didn't offer 262, I offer that as well. 


(Exhibit 261 received into evidence.) 


Q. What is 261? 


A. This is the supporting document for the 8K for Tesla 


reporting that same entry into a material definitive agreement. 
MR. FRANK: Could we go to the next page, please. 


Q. Do you see the same text that we just looked at in the 


screenshot in the actual filing? 


A. Identical language, yes. 


MR. FRANK: Could we have 261A, please. 
And, Ms. Lewis, if you could leave -- I'm sorry, if 


you could leave 262 on the left, do 261A on the right. 


Q. What is the date that the document was filed wit 


Securities and Exchange Commission? 
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A. October 20, 2017. 

Q. And what was the date that the screenshot appeared in the 
Apple iCloud account of Olga Opukhovskaya? 

A. The day prior, October 19. 

MR. FRANK: Thank you, Special Agent. 

Ms. Lewis, you can take that down. 

THE COURT: Why don't you stand and stretch fora 
minute. I'll see the attorneys on a small issue. 

(At sidebar on the record.) 

THE COURT: First of all, I just thought everyone 
needed a stretch. It's very dense. It's very dense. 

How much longer do you have with him? 

MR. FRANK: Quite a bit, your Honor. It's going to 
be -- it's tough to estimate, but I would say at least again 
what we've done, so probably another hour anda half, two 
hours. 

THE COURT: Oh, my goodness. 


I have to leave a little early in terms I have a phone 


:00, so I'll probably break at five of 11 to get 


know we have a few things to go through. 


First of all, I thought your paralegal actually did a 
great job that neither of you two did. 
MR. KOSTO: That's usually the case. 


THE COURT: Which is we can blow up the license 


plates, so part of the car without -- yours was like you needed 
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to have special glasses to see it, and yours was the whole car. 


So I thought her screenshot picked up the fact that they looked 


like similar cars plus the license plates. So I thought tha 


was a good solution, the Goldilocks solution. So that's tha 

Second of all -- 

MR. FRANK: May I ask, do you propose to change the 
exhibit? 

THE COURT: I can't. I just marked it for ID, if you 
remember. 


So, yes, so what she did I thought was brilliant. 


You said could you blow up the license plates and it 


showed part of the car, and you could tell they were similar 


cars without accentuating -- 


MR. KOSTO: We'll find a way -- 


THE COURT: I thought she did a great job. 
Yours was too hard to read, and yours was the 


1-blown -- you can maybe know that it was a Porsche, but you 


ld sure tell they were fancy cars. 


Let me ask about it -- I can't understand the document 


that came in at midnight last night. 


I'm looking at it, I don't understand it. So have you 
had a chance to even look at it? 


MR. NEMTSEV: I just noticed that it was a message 


with something, I actually didn't even read it. 


THE COURT: It's unfair to do that. Given the fact 
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that you have the half hour during the break, could you at 
least look at it, see if you object, and if you do, we will 
have to hold some sort of -- we'll start on cross but I may 


allow with him to deal with it on redirect if there's a 


question as to what it means. 

MR. KOSTO: May I just say that we sent the document 
at 7:00 p.m., not midnight. And certainly we've had a chance 
to talk about it with Mr. Nemtsev and its content, and we'd be 


glad to address the substance of the document with the Court 


when the Court is ready. 


It only came up because the venue issue has really 
changed -- 


THE COURT: We've known about venue from the get-go. 


We've known about it from the get-go. With that said, I'm not 


saying I'm precluding it, I think it's bad form to give -- 


THE CLERK: Bathroom break for a juror. 


THE COURT: Sure. 


THE CLERK: Let me hit the door, one second. 


MR. KOSTO: We totally understand. We're not 
challenging that. We'd like to advise that we learned of the 
existence of the document and we got the document within the 
hour that we turned it over to the defense. 

THE COURT: I'm not trying to say that you were hiding 
the ball. I'm just simply saying we need to understand it. 


MR. KOSTO: Absolutely. 
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COURT: 
MR. KOSTO: 
reasons that 


THE COURT: 


simply -- I don't understand it. 


prepared 


t. A 


it's great 


MR. KOSTO: 
THE COURT: 

them is taking notes, 

a minute Mr. 


for a minute. 


it came up is 


This is hard sledding, 


I'm not challenging its relevance. 


to rule on the fly. 


11 right. 


When you explain 


They got it at 


okay. 
And one of the reasons -- one of the 


the Court had questions about -- 


I am 


7:00. I'm not 


things to me, 


We'll be ready to do that. 


All right 


Now one last 


okay. 


Sladkov is insider trading, 


Is there some -- 


let's 


thing, 


not one of 


let's assume for 


just assume that 


That doesn't necessarily mean -- is there going 


to be like a flow chart as to who you're talking about and 


Sladkov isn't even a named conspirator? 


MR. FRANK: 
THE COURT: 
MR. FRANK: 
THE COURT: 
MR. FRANK: 


closing, 


put in the evidence. 


THE COURT: 


He is an unindicted co-conspirator. 


He's not a named defendant. 


Correct. 


Are you going to have some big chart -- 


We're going to put it all 


I'm not faulting you, 


not one of them is taking notes. 


MR. FRANK: 


THE COURT: 


together in 


because we don't have a cooperating witness we have to 


I'm simply saying 


Hopefully because it's crystal clear. 


Let's 
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THE CLERK: A few people had to step away, including 
the witness, Judge, to go to the men's room. 

(Discussion off the record.) 

(End of sidebar discussion.) 

THE COURT: Okay. Let's go. We're going to break at 
five of, because I have a call at 11, for our real break. 

Is the food out there yet? 

THE CLERK: Not yet. It will be. 

THE COURT: Let's go. 


MR. FRANK: Just for the record, your Honor, we've 


replaced the chalk with a chalk with the names correctly 


identified. 


O. Special Agent, I want to ask you now about Exhibit 78, and 


if we could call that up and I'd offer it. 
(Exhibit 78 received into evidence.) 
What is Exhibit 78? 
This is a screenshot. 


And where did you find it? 


Ivan Ermakov's Apple account. 
So you didn't find content of communication, but you did 
this screenshot? 


Yes. 


And what is the -- if we could enlarge the top left -- 


is the app that this screenshot is of? 


The SaxoTraderGO app. 


Case 1:21-cr-10104-PBS Document 183 Filed 02/06/23 Page 88 of 176 


Q. And is there a security of a particular company depicted 
on the screenshot? 
A. Avnet. 

MR. FRANK: And, Ms. Lewis, if you could enlarge the 


lower left -- 


Were you able to determine the date of the screenshot? 
Yes. 
What is it? 
January 23, 2020. 
So that's in Cyrillic, but it's January? 
It's the abbreviation for January, yes. 
And that number on the lower left, 331453INET, what is 
number? 
That is the account number associated with a Saxo account. 
And again, this screenshot was found in whose iCloud 
account? 
A. Ivan Ermakov. 


MR. FRANK: Could we call up Exhibit 97 on the right. 


And I'd offer it. 
(Exhibit 97 received into evidence.) 


What is Exhibit 97? 


This is the first page of a financial statement for a Saxo 


account in the name of Vladislav Klyushin. 


MR. FRANK: And, Ms. Lewis, can you enlarge the 


account number in the middle of the page, please. 
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Ors How does the account number of Mr. Klyushin's account 


compare with the account number depicted in the image of | 
SaxoTraderGO app found in Mr. Ermakov's iCloud account? 
A. The same. 

Q. Besides Mr. Ermakov, did you learn of any other 
individuals who had the ability to access Mr. Klyushin's 


iCloud -- Saxo account? 


Who was that? 


Nikolai Rumiantcev. 


MR. FRANK: Could we look at Exhibits 134 and 134A, 


And I'd offer these. 
(Exhibits 134 and 134A received into evidence.) 


at is Exhibit 134? 


is is a power of attorney for a Saxo Bank account. 


d what is 134A? 


e Russian language version. 


d who -- whose account does this involve? 


Vladislav Klyushin. 


And who did Mr. Klyushin give power of attorney over the 


account? 


Nikolai Rumiantcev. 


Besides Mr. Klyushin, as part of your investigation, did 


you learn that any other individuals also had brokerage 
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accounts at Saxo Bank? 
A. 


on Before we move on, what is power of attorney, if you tell 


A. This gives an individual the ability to have access to the 
account. There are certain -- there are different kinds of 
power of attorney, but this would allow for access to the 
account. 


Q. And who were the other individuals who you determined also 


had brokerage accounts at Saxo Bank that we've discussed? 
Rather than test your memory, why don't we just look 
at the documents. 
MR. FRANK: Can we look at 94, please. 
And I'd offer it. 
(Exhibit 94 received into evidence.) 
What is 94? 
This is a financial statement for a Saxo account in the 


of Alexander Borodaev. 


MR. FRANK: Could we look at 95, please. 


This is similar for Mikhail Irzak. 


And 96. What is this? 


Similar for Sergey Uryadov. 


MR. FRANK: So the government offers 94, 95 and 96. 
(Exhibits 94, 95, 96 received into evidence.) 


So all three of those individuals had accounts at Saxo? 
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MR. FRANK: Could we look at 68, please. 
And I'd offer it. 
(Exhibit 68 received into evidence.) 
Q. What is Exhibit 68? 
A. This is the download portion of an Apple subscriber record 
for Ivan Ermakov denoting a certain download of the 
SaxoTraderGO app. 
Q. What does Exhibit 68 indicate about when Mr. Ermakov put 
the SaxoTraderGO app on his device? 
A. October 30, 2019. 
Q. What does the exhibit indicate about the IP address that 
Mr. Ermakov used when he downloaded the SaxoTraderGO app to his 
device? 
It was 89.107.124.42. 
part of your investigation -- 
By the way, did you -- were you able to determine 


whether Mr. Ermakov himself had an account at Saxo? 


A. We did not locate an account in the name of Ivan Ermakov 


at Saxo. 


Ox As part of your investigation, did you obtain records for 


the 89.107.124.42 IP address that Mr. Ermakov used to download 


the SaxoTraderGO app to his device? 
A. Yes. 


MR. FRANK: Could we look at 186 and 187, please. 
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What are these documents -- 
MR. FRANK: And I'd offer them. 
(Exhibits 187 and 187 received into evidence.) 
These are records from DomainTools. 
What is DomainTools? 
A commercial registry for domains and IP addresses. 


Directing your attention to 187 on the right, do you see 


an IP address depicted at the top of that document? 
A. 
Q. Is that the same IP address that we just looked at, 
89.107.124.42, that Mr. Ermakov used when he downloaded the 
SaxoTraderGO app to his device? 

Yes. 


Who does that IP address resolve to? 


M-13. 
Klyushin's company? 
Yes. 


And at 186, I'd like to look at a similar document for a 


Similar IP address. What is the IP address depicted in 186? 


89.107.124.39. 


And who does that 89.107.124.39 IP address resolve to? 


M-13. 


Special Agent, I'd now like to show you a series of 


exhibits depicting the use of these IP addresses. Okay? 


A. Yes. 
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MR. FRANK: Ms. Lewis, could we begin with Exhibit 79. 


What is Exhibit 79 -- 
MR. FRANK: And Ms. Molloy, I'd offer it. 
(Exhibit 79 received into evidence.) 
THE CLERK: Thank you. 
Facebook subscriber records for the M-13 Facebook account. 
MR. FRANK: And if we could start actually at the very 


back of the document, Ms. Lewis. 


Q. So at the bottom of the page, the name of the account is 


M-13; is that correct? 


what does it indicate is the registration IP for this 
account? 
A. S910 7 xl 4.39 TP, 
Okay. And that's the same M-13 IP that we just looked at? 
VES 
And you see it's also depicted at the top of the page? 


Yes. 


And what does that indicate? 


That was access to the M-13 Facebook account from the 89 


IP ending in .39. 


Q. If we could just slowly scroll up through this document, 


page 5. 
Do you see that IP address on page 5? 


Repeated access, yes. 
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Page 4, do you see that IP address on page 4? 


Q. By the way, the first entries were in 2017; is that 


correct? 
Yes. 


And these entries are in what year? 


2018. 
And if we go up, another page. 


Do you see that IP address again? 


MR. FRANK: Could we go up another page. 


Q. And now on page 2, Special Agent, I want to direct your 


attention to the middle. 


Do you see another 89 IP address indicated there? 
MR. FRANK: Ms. Lewis, if you could just highlight it. 
Thank you. 


Is that the other M-13 89 IP address that we just looked 


Yes. 


And where did you get these records? 


Facebook. 


Q. And if we go to the top, what's the latest entry that's 
depicted on this particular record? 


A. November 8, 2019. 
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MR. FRANK: Could we now look at Exhibit 242. 


And I'd offer it. 


(Exhibit 242 received into evidence.) 


Q. What is Exhibit 242? 


A. This represents the use of the M-13 89 IP used to access 
the Ivan Ermakov iCloud account. 

Q. Okay. I'm sorry -- 

A. The records were spanning the time period January 1, 2017 


to June 23, 2020. And below you see the specific dates that 


the 89 -- the M-13 89 IP accessed the Ivan Ermakov account and 
with what frequency on that day. 

So this is a summary of records? 

Yes. 


And the underlying records were obtained where? 


From Apple. 


And so just to clarify, on May 11, 2018, it looks like the 


IP address was used four times to access the iCloud account? 


A. 


Q. And then on June 15, 2020, how many times was that same IP 
address used to access Mr. Ermakov's iCloud account? 
A. Between five and ten, closer to ten. 
Q. I'm sorry, June 15, 2020. 
Closer to 30 on that last entry. It spiked. 


MR. FRANK: Could we look at 243, please. 


What does this chart depict? 
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A. The use of the same M-13 89 IP used to access Nikolai 
Rumiantcev's iCloud account. 
Q. And what was the date range depicted in this chart? 


A. The dates provided by Apple span May 1, 2017 through 


January of 2021, but down in the bottom, these are the specific 


dates that the M-13 89 IP were accessed, were used to access 


the Nikolai Rumiantcev Apple account. 


Q. And just to clarify, why are the dates for the Apple 
records slightly different in each of these charts? 


ey were obtained from Apple at different points in 


d what does this chart indicate about the trend of t 


cy? 


ere's a spike, an increase in the -- later 2020 time 


MR. FRANK: And I offer 242 and 243, and now I offer 


(Exhibits 242, 243, 244 received into evidence.) 


What does 244 indicate? 


A. Use of both of the M-13 89 IPs used to access Vladislav 
Klyushin's Apple iCloud account. 

Ol. And what is the date range of this exhibit? 

A. The Apple records spanned January of 2018 to October of 
2020. And then down below you'll see the specific dates that 


those two IPs were used to access the Klyushin Apple account. 


Or. Now I'd like to talk to you about Exhibits 230 through 
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MR. FRANK: And I'd offer those beginning with 230. 


(Exhibits 230, 231, 232 received into evidence.) 


O's What is depicted in Exhibit 230? 


A. This is use of the same M-13 89 IP used to access Ivan 
Ermakov's WhatsApp account. 

Q. And what's the date range? 

A. The overarching date range is May 2020 to May 2021, and 
the access occurred between June 8th of 2020 using that IP and 


spanned to April 2021. 


Q. Okay. And so, for example, on June 8th, there's very few 
accesses of the WhatsApp account from that IP address? 
Correct. 


What about on November 23, 2020? 


It increases. There are over 140, it looks like closer to 
accesses on that day. 


And again, those are accesses of Mr. Ermakov's WhatsApp 


account from the M-13 IP? 


A. On specific days. 
MR. FRANK: Could we look at 231, please. 
oF What are we looking at in 231? 


A. Similar chart. This time for the M-13 89 IP address 


accessing Nikolai Rumiantcev's WhatsApp account. 


Q. And do you see a similar increase in 2021? 


A. 
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MR. FRANK: Could we look at 232, please. 


Q. What is depicted in Exhibit 232? 


A. Use of the M-13 89 IP address used to access Vladislav 
Klyushin's WhatsApp account. 

O's And what's the date range? 

A. It spans October 2020 to April 2021. 


On And again, why are these the particular dates that are 


depicted? 
dates in the bottom? 


dates at the top. 


dates at the top are the dates that pen collection was 
obtained from Apple. 
Os So this data in the WhatsApp charts that we've just looked 
at came not from Apple but from 
A. WhatsApp. 
From a WhatsApp pen? 
Yes. 


Again, remind us what that is, a pen register. 


We -- it is the caller ID, the "to" and a "from" for a 


particular WhatsApp account, in this case Vladislav Klyushin's. 


0. So why are there no hits on the pen register before 


October 2020 for Mr. Klyushin? 


A. Because we didn't have a court order authorizing us to 


that information. 


And going back to 231, similarly, you obtained a pen 
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register for Mr. Rumiantcev in November of 2020? 
A. Correct. 
O': And 230. You obtained a pen register for Mr. Ermakov in 
May of 2020? 
A. Correct. 
Q. Could we look at -- well, withdrawn. 
MR. FRANK: You can take that down, Ms. Lewis. 

OQ. At any time did the FBI obtain records from brokerage 
firms about IP addresses to access brokerage accounts for 
Mr. Klyushin, Mr. Rumiantcev or any of the M-13 investors that 
we've talked about? 

VES 

And did you obtain those records from Saxo? 

Yes. 

And from OTK? 

VES. 

And that's OTKritie broker we looked at earlier? 


Yes. 


MR. FRANK: Beginning with Exhibit 227 -- and I'm 


going to offer, Ms. Molloy, 227, 228, and 229, and I believe I 


just offered 230 through 232. 


(Exhibits 227, 228, 229 received into evidence.) 


on Beginning with 227, what does 227 depict? 
A. This is the use of the two M-13 89 IPs to access Alexander 


Borodaev's Saxo account between October 28, 2019 and September 
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6 of 2020. 
Q. So both of those 89 M-13 89 IPs were used to access 
Borodaev's account during that time period? 
Consistently. 
Again, why that time period? 
That's when the records were obtained. 
MR. FRANK: And could we look at 228, please. 
Q. What does 228 depict? 
A. This is use of the two M-13 89 IPs used to access the 
Sergey Uryadov Saxo account between October 24, 2019 and 
September 6th of 2020. 
Q. And what does it depict? 
A. That there's consistent access from those two IPs from 
account creation until the end of the records provided. 
Q. And Mr. Uryadov, again, who's that? 
As One of the investors. 
MR. FRANK: Could we look at 229, please. 


What does this depict? 


Use of the two M-13 89 IPs to access the Vladislav 
Klyushin Saxo accounts. 


Q. Now, there are a lot of colors in this chart. Why is 


that? 


Bs There were two different individuals -- remember we looked 


at earlier a power of attorney form allowing Nikolai Rumiantcev 


to access Klyushin's Saxo account. So here we have two 
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different individuals that were accessing those certain 
accounts from the two M-13 IP addresses. 

Q. And these underlying -- the underlying records that are 
being summarized here, who provided those records? 

A. Saxo. 

OF And how were you able to determine which of the accesses 
over the M-13 89 IP to the Klyushin Saxo account were 
attributable to Mr. Klyushin and which were attributable to 
Mr. Rumiantcev? 


A. Saxo assigned Nikolai Rumiantcev his own user ID. They 


could track which user accessed which account. 


Q. Finally, I'd like to turn to OTK, OTKritie broker. 


MR. FRANK: And if we could look at Exhibits 222 


through 226. 


Which I offer, beginning with 222. 


(Exhibits 222, 223, 224, 225, 226 received into 


evidence.) 


Q. What's in Exhibit 222? 


A. Use of the two M-13 89 IP addresses to access Alexander 
Borodaev's OTK account. 


Q. So this is different brokerage where these individuals 


also had brokerage accounts. 
A. Correct. 
Q. And what does it depict is occurring between 2018 to 2019? 


A. From account opening spanning this time period, both IPs 
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access it and the -- the .42 picks up toward the middle of date 


range. 
Q. And Mr. Borodaev, again, is who? 
A. An investor. 
MR. FRANK: Could we look at 223, please. 
Q. What are we looking at in 223? 
A. The two M-13 IP addresses used to access the Boris 
Varshavksiy OTK account. 
Q. He's another of the investors? 
A. Yes. 


MR. FRANK: And could we look at 224, please. 


Q. What's depicted here? 
A. Use of the two M-13 89 IP addresses to access the Nikolai 
Rumiantcev OTK account. 
Q. So Mr. Rumiantcev had a personal account at OTK brokerage? 
In his name. 
And Mr. Rumiantcev, again, is who? 


An employee of M-13. 


Okay. And he was the individual with power of attorney 
Mr. Klyushin? 
Klyushin's account. 
MR. FRANK: And could we look at 225, please. 
What are we looking at in 225? 
Use of the two M-13 89 IP addresses to access Sergey 


Uryadov's OTK account. 
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He's the third investor we've been speaking about? 

Yes. 

And the date range? 

April 22, 2019 to November 18 of 2019. 

MR. FRANK: And 226, please. 

Ox What does 226 of depict? 
A. Use of the two 89 IP addresses associated with M-13 used 
to access Klyushin's OTK account between June 29, 2018 and May 
20 of 2021. 


Q. And why are these lines so small? 


A. Mr. Klyushin was arrested March 21 of 2021. 
on Thank you, I was actually asking you a slightly different 


question, which is why are they so narrow? 


A. So this spans several years, and if you were to zoom in on 


a particular section, you would see that there was access on 


individual dates; but when it is zoomed out, it appears all as 
one line. 


O.~ There's a lot of dates in which these IPs were used to 


access the OTK account? 
A. Yes. 


THE COURT: I'm going to need to -- 


MR. FRANK: I have magically come to the end of that 
section, your Honor. 
THE COURT: All right. So we'll be back here at 


11:30, thank you. 
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THE CLERK: All rise. 
(Recess taken.) 
THE CLERK: All rise. 
(Court enters.) 


THE COURT: How long do you think you're going to be? 


MR. FRANK: It's going a little slower than I'd hoped, 
Your Honor. I hope to finish. 
THE COURT: Finish it today? 


MR. FRANK: I hope so. It's our entire case, Your 


COURT: What? 
FRANK: This is the main part of the case. 


COURT: Let me ask you this. By accident, someone 


wrote on -- is this the original that you gave me? 


MR. KOSTO: No, that's just a color copy. 
THE CLERK: Copy for you. I'll write "copy" on it so 


you don't get confused. 


THE COURT: We weren't sure if it was the original. 


THE CLERK: No, that won't go in the book, no. 


MR. KOSTO: I can't remember the last time I've held 
an original anything, Your Honor. 


THE COURT: I just wanted to make sure, because it 


looked like the signature was in ink. 
Do you know whether you're going to be opposing the 


introduction of this Cogent material? 
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MR. NEMTSEV: I will, Your Honor, especially 


considering the fact that I briefly spoke with our expert on 


this subject matter and he says whatever the government told 


me, they're overstating what that record says. It does not 


state that Cogent put an IP -- that IP onto a server in Boston. 


All it says, that document, is Micfo got authorization to 
advertise that this IP address is in Boston. And Cogent saw 


that authorization from the owner of the IP and said that's 


okay. But it did not say -- 


THE COURT: So with that limitation, are you opposing 


MR. NEMTSEV: He can cross on that, but the 
document -- 


THE COURT: No, just with that limitation, is there an 


opposition to it? 


MR. NEMTSEV: I mean, the only opposition I have is 


it's 802, Your Honor, because it's a message. It's a customer 


service ticket back and forth between Cogent and Micfo, but 


that's about it. I think if somebody wants to testify to what 


it actually says, then they would have to come into court and 
explain it. 


THE COURT: That's a different story, but the 


threshold issue is they did the certificate, and it looks like 


it's a business record. 


MR. NEMTSEV: It does look like it's a business record 
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or it does look like it's authentic. I have no doubts about 


the authenticity. 


THE COURT: 11 right. 


THE CLERK: ll rise for the jury. 


(Jury enters.) 
THE COURT: All right. 


MR. FRANK: Thank you, Your Honor. 


Your Honor, may I put another chalk up on the easel? 
THE COURT: Which one is it? 
MR. FRANK: This is this one. 
COURT: Okay, yes. 
MR. FRANK: Okay. 


THE COURT: I want to make sure that the defense gets 


to see it. 
MR. NEMTSEV: We've seen it, Your Honor. 
THE COURT: Okay. 

BY MR. FRANK: 


Q. Okay. Special Agent, this next section of the examination 


is going to involve some complicated discussions of IP 


addresses. So we've prepared this demonstrative to help the 


jury understand. Can you see it from where you're sitting? 


A. I can. It's a little difficult, but I can. 


Or T'll describe it to you. 
THE COURT: If he can, he's got a rubber neck 


because -- 
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THE WITNESS: Do we have a hard copy that you could 
share with me? 

THE COURT: Can we put one on the doc camera? 

THE CLERK: Yeah. Or Jenn could put it up. We can do 
the doc camera. Whatever you want. Just tell me if you want 
me to switch up. 

MR. FRANK: Yes, please. 

CLERK: Do you want to do the doc camera? 
FRANK: Just for a moment. 

CLERK: Okay. It just takes a second. 
FRANK: It's the latest in 1970s technology. 


CLERK: It does take a second. 


COURT: It is so frustrating. I can't even tell 


CLERK: I always play with the buttons. Is it up? 


MR. FRANK: Can everyone see? Okay. 
Q. All right. Special Agent, before we go through the 


documents, if you could just take a moment and help us 


understand the various entities that we're going to be talking 


about. So beginning on the left under "filing agent," that's 
the company we've been talking about, Toppan Merrill? 
A. 


Q. Then there's a column "domain names," and there's 


entity called Namecheap. What is Namecheap? 


A. Namecheap is a domain registrar. They allow the general 
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public to buy domain names. 
Q. So they sell domain names? 
A. 


Q. So like www.developingcloud.info or smartfinancelist.com, 


those kinds of things you could buy from Namecheap? 
A. 
Q. And then below that there's an arrow, and there's a little 
symbol for Bitcoin and then there's an entity called BitPay. 
What is that depicting? 
A. BitPay is a payment processor that allows one to pay for 
services such as a do -- or a product. 

MR. FERNICH: Judge, I'm going to object to this under 


702. It's not the right witness for this, in our view. 


THE COURT: How do you know this? 


THE WITNESS: Over the course of the investigation, I 
obtained records from these companies and learned what type of 
businesses they conduct. 


THE COURT: All right. Overruled. 


Ox What is BitPay? 


A. BitPay is a payment processer that allows for the payment, 


by way of Bitcoin, for something like a name -- Namecheap 
domain. 

Oz And then what is -- do you see the column that says 
"virtual server companies"? 


A. Yes. 
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Q. What are those entities, Vultr and Digital Ocean? 

A. They resell, to the general public, access to virtual 
servers. 

O's How are virtual servers used in connection with domain 
names? 

A. A domain name will be assigned an IP address. The IP 
address will be assigned to a server. So in this case, we saw 
Namecheap domains purchased and put onto the servers at Vultr 
and Digital Ocean. 


Ox So just like you can buy a domain name, you can rent space 


on a virtual server, somebody else's server -- 
THE COURT: Let's go from base. What is a virtual 
server as opposed to a server? 


THE WITNESS: A virtual server is when you have a 


physical server and you slice it up into little pieces, and 


each of those individual pieces are then turned into a virtual 


server. So -- 


THE COURT: I thought a server was a machine. 


[THE WITNESS: It is. 


[THE COURT: All right. 


THE WITNESS: And a virtual server is a server within 
a server, so it allows you to take a very -- 


MR. FERNICH: Respectfully, same objection. 


COURT: Overruled. 


WITNESS: It allows you to take a very powerful 


Case 1:21-cr-10104-PBS Document 183 Filed 02/06/23 Page 110 of 176 
4-110 


computer and use its resources and share it amongst other 

servers that are inside of the server. So a good analogy -- 
THE COURT: Are these two companies used in this case? 
THE WITNESS: Yes, ma'am. 

Q. So can you rent space on a server from Vultr or Digital 

Ocean and put your IP address there? 

A. 

Q. And then in the next column there are virtual server 

resellers, and there's two companies listed there, 99Stack and 

BitLaunch. What do they do? 

A. They take the virtual machines from Vultr and Digital 

Ocean and resell. They're a man in the middle that is making a 


profit off of reselling those same services. 


Q. So that's like you could buy Kellogg's cereal or you could 


buy the Whole Foods brand that's also made by Kellogg's? 
A. Yes. 
FERNICH: Objection. 


COURT: Yeah. Sustained. That metaphor was -- 


MR. FERNICH: It's telling me something I don't know. 


THE COURT: If I can understand it, then it's not a 
good analogy. 


So they're reselling the little slices of the machine? 


THE WITNESS: Yes. Yes, Your Honor. 


THE COURT: But are they physically part of the 


machine? 
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THE WITNESS: Yes. 

THE COURT: All right. 
Os Is it space on the machine? 
A. Yes. If we think of it as a hard drive, it's a piece of 
the hard drive, a sliver of it. 


Os Okay. With that as background, in the course of the FBI's 


investigation, did the FBI obtain records from Namecheap? 


Yes. 

And where is Namecheap based? 

The United States. 

For which domain names did the FBI obtain records from 
Namecheap? 


A. Toppan Merrill provided domain names that they observed in 


the intrusion, and we requested records for those domain names 


from Namecheap. 


Q. And did there come a time when you ultimately also 


obtained records for domain names provided by DFIN? 


A. Yes. 


On Okay. 
MR. FRANK: Ms. Molloy, if we could now switch. 
THE COURT: Well, there's still another one. 


MR. FRANK: We're going to have to go back and forth, 


Your Honor, because we're now introducing some exhibits for 
which I need the computer. 


THE CLERK: Okay. I'm back to Jenn's, but it takes a 
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second when I toggle. Hopefully it will work. 


On Have you previously had an opportunity to review 


Exhibits 173C through 173M? 


What are they? 

Namecheap subscriber records. 
MR. FRANK: The government offers 173C through 173M. 
(Exhibits Nos. 173C-M received into evidence. ) 
MR. FRANK: And I don't believe we marked this chalk 


for identification. I think the last one was CC. 


MR. KOSTO: This is AAA. 

MR. FRANK: Oh, this is AAA? 

THE CLERK: This is AAA. Thank you. 
Q. If we could begin with -- and 173C through 173M, those are 
the domain names that you received from -- predominantly from 
Toppan Merrill, but also from DFIN? 
A. 


O:. If we could look at 173C. And if you could -- 


MR. FRANK: Ms. Lewis, if you could enlarge that. 
Q. And, Special Agent, if you could tell us what we're 


looking at. 


A. This is the Namecheap account for Malika Ellis. 


Q. And if we could look at page 2. What domain name was this 


account for Malika Ellis associated with? 


A. developingcloud.info. 
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Q. Okay. And what is the email address that is associated 
with Malika Ellis? 
A. First name, last name, followed by two numerical digits 
@inbox.lv. 
And inbox.lv, that suffix, what country is that from? 
Latvia. 
Ox And if we could now go to page 1. And do you see on the 


right-hand side of the screen it says "latest transaction, 


latest login, login IP"? What does that represent? 


Ax This is the IP address that last logged in. 
©: Can you read that IP address for the record? 
A. 89.238.166.235. 


Oi. Now, before the break we were talking about two M-13 IP 


addresses beginning with the digits 89. 
Do you recall that testimony? 
Yes. 
This is a different IP address, correct? 


Yes. 


And this IP address, does this come back to M-13? 
No. 


THE COURT: This goes back to Latvia? 


THE WITNESS: No, the email address inbox.lv, the 


"lv" is the country code for domains associated with the 


country Latvia, the lv. 


©. Do you have to be in Latvia to have an inbox.lv email 
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address? 


Okay. 


MR. FRANK: Could we look at 173D in evidence, please. 


And if we could go to page 2. 


THE COURT: Just so it's not confusing. That 89 


address is not one we've seen before? 
THE WITNESS: No, ma'am. This is a new one. 
What is this document, which domain is this document for? 
smartfinancelist.com. 
And who is the registrant for this domain name? 
magnoliafreeda20@inbox.lv. So first name, last name, 


followed by two numerical digits @inbox.lv. 


Q. If we could go to page 1. Under "last login," what is the 


IP address that's depicted? 
A. 69.230 4166.235.% 


0. And was this another domain name associated with Toppan -- 


with a hack on Toppan Merrill? 


A. Yes. 
MR. FRANK: Could we go to 173E, please. Could we go 
to page 2, please. 
Q. What domain name is this for? 
A. scoreyourmoney.com. 
Q. And this was another one associated with a hack on Toppan 


Merrill? 
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A. 
Q. What is the email address associated with the registrant 
for this domain name? 


A. lienroberto99@inbox.lv. First name, last name, followed 


by two numerical digits @inbox.lv. 
MR. FRANK: If we can go to page 1, please. 
Q. Could you tell us what the IP address associated with the 


last login is? 


A. The same 89.IP. 
MR. FRANK: Could we look at 173F, please, page 2. 
What is the domain name for this record? 
fnwallinform.info. 


Is this yet another domain name that you obtained from 


Toppan Merrill? 


A. Yes. 
Q. What is the email address of the registrant for this 
domain name? 


A. First, last, two numerical digits @inbox.lv. 


MR. FRANK: Could we go to page 3 of this record, 
please. 
What is page 3? 


This is the login history for that account. 


Do you see the same 89.IP in this login history? 
Yes. 


MR. FRANK: Ms. Lewis, could you highlight it, please. 
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Q. And I want to direct your attention to the IP address 
above that one. What is that IP address? 
A. 64.42.179..59. 
Oe Thank you. 
MR. FRANK: Could we look at 173G, please. Page 2. 

Thank you. 

What is the domain name for this record? 

cloudapifinance.info. 

What is the email address of the registrant? 


First, last, two numerical digits @inbox.lv. 


MR. FRANK: Ms. Lewis, can you please take us to 
3.5 
This is the login history again? 
Yes. 
Do you see an IP address that you recognize? 
The 89.238 IP. 
235? 


Yes. 


MR. FRANK: Could we look at 173H, please. Page 2. 


Which domain name is this the Namecheap record for? 


financecloudapi.com. 


This is another one that you obtained from Toppan Merrill? 


Yes. 
What is the email address of the registrant? 


First, last, two numerical digits @inbox.lv. 
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MR. FRANK: Could we look at page 1, please. 
Do you recognize an IP address on page 1? 
The 89.238 IP. 
Does it indicate -- oh, 89.238.166.235? 
Yes. 
Thank you, Special Agent. 

MR. FRANK: Could we look at 1731, please. 
What domain name is this record for? 
finshopland.me. 


What is the email address of the registrant? 


First, last, followed by two numerical digits @inbox.lv. 


Was this yet another domain name you obtained from Toppan 
Merrill? 
A. Yes. 


MR. FRANK: Could we go to page 3, please. 


Q. Special Agent, I want to direct your attention to another 


IP address. Could you read the last IP address in this column? 


A. 199.249.230.17. 


Q. Thank you. 
MR. FRANK: 1933, please, page 2. 


What domain name is this record for? 


shopservice.live. 


What is the email address of the registrant? 


First, last, followed by two numerical digits @inbox.lv. 


MR. FRANK: Could we go to page 3, please. 
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Do you see an IP address that you recognize? 


199.249.230.177. 


Is that the one we just looked at that was associated with 
finshopland? 
A. Yes. 
MR. FRANK: Could we look at 173K, please. Page 2. 
What domain name is this record associated with? 
appfinreport.info. 


What is the email address? 


First, last, followed by numerical digits at inbox.lv. 
MR. FRANK: And could we go to page 3, please. 

Do you recognize the 89 IP address on this record? 

Yes. 


You also see the 64 IP address that we looked at a moment 


MR. FRANK: 173L, please. 


Os. Now, this record, if we go to page 2, was this one 


domain names you received from DFIN? 


What is the domain name? 


finauditsolutions.com. 


Or What is the email address associated with this domain 
name? 


A. First, last, followed by two numerical digits at inbox.lv. 
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MR. FRANK: Could we go to page 3, please. 
Q. Do you recognize any of those domain names? I'm sorry, IP 
addresses. 
A. I do. 
Which one? 
89.238.166.235. 
O.< Did we also see that IP address associated with the domain 
names that you obtained from Toppan Merrill? 
A. Yes. 
MR. FRANK: Could we look at 173M, please, page 2. 
What domain name is this record for? 
investmentcomp.com. 
Was this one of the domain names you received from DFIN? 
Yes. 
MR. FRANK: Could we go to page 3, please. 
Could we go back to page 2. 
©). What is the email address of the registrant? 


A. First, last @inbox.lv. 


MR. FRANK: Could we go to page 3, please. 


Q. Do you recognize any of the IP addresses that were 


associated with the domain names you obtained from Toppan 
Merrill on this domain name record that you obtained -- 


associated with the domain name that you obtained from DFIN? 


Which one? 
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Q. Each of those records, Special Agent, had an email 


registrant with a first name, last name and an inbox.lv suffix? 


Yes. 

And we saw several of the same -- 
Yes. 

What does that indicate to you? 
That the -- 


MR. NEMTSEV: Objection. 


common IP addresses? 


THE COURT: Was that an objection? 


MR. NEMTSEV: Yes. 


THE COURT: Overruled. 


Could you repeat the question, please. 


What does that indicate to you? 


A. That the same individual or group 


administered these Namecheap accounts. 
Q. Okay. 
MR. FRANK: You can take that 
Your Honor, could I just have 
write the exhibit numbers under domain 
the jury's reference? 


THE COURT: I'm not sure it's 


of individuals 


down, Ms. Lewis. 
Special Agent Hitchcock 


names on the chalk, for 


worth taking the time 


right now. I'd like to finish at least the direct by lunch. 


So maybe we'll add them later. We can 


MR. FRANK: Okay. 


talk about it. 
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Os Beginning with two of the domain names, 


smartfinancelist.com and scoreyourmoney.com, were you able to 
determine what computers those domain names were assigned to? 
Yes. 
Where were those domain names assigned to computers? 


Digital Ocean. 


So looking again at our chalk, Digital Ocean was one of 
the two virtual server companies that we discussed? 
A. Yes. 
OQ. Did the FBI obtain records from Digital Ocean in relation 


to the Namecheap domains smartfinancelist.com and 


scoreyourmoney.com? Those were Exhibits 173D and 173E in the 


Namecheap records. 
Yes: 
Where did you obtain those records from? 


From Digital Ocean. 


Was there also a company called BitLaunch involved? 


Yes. 


Okay. And tell us about the connection between Digital 
Ocean and BitLaunch? 
A. So in order to identify that BitLaunch was the third-party 


reseller, we reached out to Digital Ocean. Digital Ocean 


points us to BitLaunch as a customer -- 
MR. FERNICH: Objection. 


COURT: Sustained as worded. 
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Part of a record that he got? 


MR. FRANK: The record is about to come in, Your 


COURT: 
MR. FRANK: to put in the record. I'll just 
put it in. 
THE COURT: All right. 


Q. Did you ultimately obtain records connected to those two 


domain names, smartfinancelist and scoreyourmoney, from 
BitLaunch? 


A. 


Q. And what was BitLaunch's role in selling that server 
space? 
As They resold Digital Ocean's virtual servers to a third 


party. 


Q. Okay. So they're all the way on the right on our chalk, 


correct? 


A. Yes. 


MR. FRANK: Let's start with Exhibit 180, and I'd 


offer it, and I'm going to offer 177, 178 and 180. 
(Exhibits Nos. 177, 178 and 180 received into 
evidence. ) 


Q. What is Exhibit 180? 


A. BitLaunch subscriber records associated with those two 


domains. 
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Were those two domains on the same BitLaunch account? 


on What is the email address of the BitLaunch subscriber who 
controlled that account? 
A. neumann@dr.com. 
Q. I'm going to come back to that in just a moment, Special 
Agent. 

MR. FRANK: Could we look at Exhibit 178, please. 


Q. What is Exhibit 178? 


A. These are the IP addresses of the servers that were 


leased. 
Q. Okay. And I want to direct your attention to two of these 
IP addresses in particular. 

Do you see there's an IP address 104.248.76.218? 


Yes. 


And do you see there's an IP address 206.189.195.244? 
Yes. 


Could we look on the -- 


MR. FRANK: If you could put this on the right, 


Lewis, and on the left put Exhibit 77A in evidence. 


oF Special Agent, do you recall the testimony about this list 


of IP addresses that the FBI obtained from Toppan Merrill? 
A. 
Q. Do you see that 104.248.76.218 IP address associated with 


the BitLaunch virtual servers on the list obtained from Toppan 
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Merrill? 
Yes. 
What about the 206.189 IP address? 
Also there. 
MR. FRANK: Thank you, Ms. Lewis. 


Q. Special Agent, did there come a time when you were able to 


obtain copies of those computer servers? 


How? 
Court-authorized search warrant. 


MR. FRANK: I'd now like to move to Exhibit 177 in 


evidence. 


at is Exhibit 177? 


ese are logs associated with the BitLaunch account, the 


neumann@dr.com BitLaunch account. 


on When you say these are logs associated with that Neumann 
account at BitLaunch, what do you mean by that? 


A. These are IP addresses that would have accessed the 


account and performed certain actions. 


O's Okay. And if I could direct your attention to page 6. Do 


you see an 89 IP address on this page? 
Yes. 
Are you familiar with that IP address? 
Yes. 


How? 
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A. It's the same 89.238.166.235 associated with the Namecheap 


accounts that we referred to earlier. 
Q. What about a 64 IP address? 


A. Yes, it's the same. 64.42.179.59. 


O's What does the presence of those two IP addresses in this 
BitLaunch record indicate? 


A. The same individual or individuals that subscribed to the 


Namecheap account and purchased those domains also subscribed 
to the neumann@dr.com BitLaunch account and oversaw those 


servers. 


Q. Were the other -- where were the other Namecheap domains 
assigned to computers? 

A. Vultr. 

On And, again, looking at our chalk, what is Vultr? 

A. A company very Similar to Digital Ocean that resold access 
to virtual servers. 

O:. Was the FBI able to determine who Vultr's customer was for 


the other domain names? 


A. Yes. 
Who was Vultr's customer? 
99Stack. 
And 99Stack, looking at our chalk, what is that? 


That's a company like BitLaunch that resells, in this 


case, Vultr's virtual machines. 


OF And where is 99Stack located? 
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Sweden. 


Was the FBI able to obtain records from 99Stack? 


MR. FRANK: Could we look at Exhibit 188, and I'd 
offer it. 
(Exhibit No. 188 received into evidence. ) 


Q. What is Exhibit 188? 


A. The subscriber records for those virtual servers that were 
associated with those particular domains. 
So those domains also came back to a common account? 
Yes. 
At 99Stack? 
Yes. 
And who -- what was the subscriber email for that account? 
neumann@dr.com. 
And the name is -- associated with it is Andrea Neumann? 
Yes. 


And if you look at the registration IP, do you recognize 


the IP address that was used to register this Neumann account? 
Yes 
What is it? 
89..238.166.235. 
What does that indicate to you? 


That the same individual or group of individuals that 


subscribed to the Namecheap account and purchased those domains 
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also bought the servers at BitLaunch, also bought the servers 
at 99Stack. 
Q. And what does that indicate with respect to the intrusions 


at Toppan Merrill and DFIN, if anything? 


A. Those domains and IP addresses were identified by Toppan 


Merrill and DFIN involved in the intrusion. So this indicates 


that it's one and the same. 
Q. Now, these Neumann records were obtained, on the right of 
our chalk, correct, from 99Stack and BitLaunch? 
A. Could you repeat the question? 
Q. These Newman records were obtained, on the right-hand side 
of our chalk, not from Namecheap? 
A. Correct. 
Q. Did you at some point go back to Namecheap to inquire 
about the -- about Andrea Neumann? 
A. Yes. 
MR. FRANK: Could you look at 173B, please, and I'd 


offer it. 


(Exhibit No. 173B received into evidence. ) 
Q. Special Agent, what is 173B? 


A. These are the subscriber records for the neumann@dr.com 


Namecheap account. 


On, And what is the IP address that was used to log into the 


Neumann Namecheap account as indicated in this record? 


A. The same 89.238.166.235 that we saw everywhere els 
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Q. So the Neumann email address was used for the accounts at 
Vultr and Digital Ocean? 
Yes. 
And it was also associated with this Namecheap account? 
Yes. 
And it was also associated with this 89.238 IP address? 
Yes. 
MR. FRANK: Could we look at page 4, please. 


From this record you obtained from Namecheap, were you 


to determine how the Neumann account was paid for? 

Yes. 

What were you able to determine? 

In the third -- or fourth column from the left, the very 
row underneath "Deposit," it says "BitPay." 

What is BitPay? 

BitPay is a payment processor that allows an individual to 


use Bitcoin, in this case, to buy a Namecheap domain. 


Q. So again, if we look at our chalk, you see that there is 


an arrow under Namecheap indicating BitPay? 


Yes. 

And there's a little logo for Bitcoin? 

Yes. 

And what is Bitcoin? 

Bitcoin is a virtual currency, a digital currency. 


Was the FBI able to obtain payment records for the Bitcoin 
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that was used to pay for the Neumann account? 
Yes. 
Where did you obtain those records from? 
From BitPay. 


MR. FRANK: Could we look at Exhibit 181, and I'd 


offer it. 
(Exhibit No. 181 received into evidence. ) 


What is Exhibit 181? 


These are transactions showing payment by BitPay for 
Namecheap accounts. 
Oi And the first account indicated on these BitPay records is 
in the name of neumann@dr.com? 
A. Yes. 


Q. Okay. There's also a second account listed on these 


BitPay records. Do you see that? 


A. 
Ol. We're not going to talk about that account right now, but 


I want to just ask you one or two quick questions about it. 


What is the name associated with that account? 
Wan Connie. 
Okay. And what is the suffix of the email address? 
inbox.lv. 
MR. FRANK: Ms. Lewis, if you could scroll all the way 
the right, Column S. 


Do you see that there's an 89 IP address associated with 
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the Wan Connie email account -- or the Wan Connie BitPay 
account? 

Yes. 

What is that 89 IP? 

This is one of the M-13 89 IPs, 89.107.124.42. 


Okay. We'll come back to that, Special Agent. 


Did the FBI obtain additional Namecheap records for any 


accounts associated with the Wan Connie identity? 
A. Yes. 


MR. FRANK: Could we look at Exhibit 173A, please, and 
i'd. offer it. 
(Exhibit No. 173A received into evidence.) 
What is 173A? 


Namecheap records for the Wan Connie account. 


And do you see the IP address recorded on the right? 
VES 
What is it? 


The M-13 89 IP. 89.107.124.42. 


MR. FRANK: Could we look at Exhibit 182, please. 
I'd offer it. 
(Exhibit No. 182 received into evidence. ) 


What is Exhibit 182? 


These are BitPay records. 
Okay. 


MR. FRANK: And if you could scroll, Ms. Lewis. 
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Q. Do you see that these BitPay records are associated with 
yet another email address? 

Yes. 

And what address is that? 

kevinspender@mail.com. 

Okay. We're going to not deal with that email address 
right now, but what did you do with the BitPay records that 
we've just looked at for this Kevin Spender account, for the 
Neumann account, and the Wan Connie account? 

A. I provided those records to an FBI virtual currency 
expert. 

OF And who was the virtual currency expert at the FBI that 
you provided the records to? 

Mr. Vincent Kenney. 

Why did you give the records to Mr. Kenney? 

He has specialized training and skills to be able to -- 

MR. NEMTSEV: Objection. 


What were you asking him to do? 


THE COURT: You gave them to somebody with specialized 


skills. What's the next question? 


And do you expect him to testify in this case? 


Yes. 
Okay. 
MR. FRANK: We can take that down. 


Special Agent, as part of your investigation, did you 
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obtain information from Toppan Merrill about an IP address with 


the first three digits 185 from which its servers were 


accessed? 
A. 
Q. Were you able to obtain additional information about the 
185 IP address? 
A. Yes. 

MR. FRANK: Could we look at Exhibit 130, please. And 
I'd offer it. 

(Exhibit No. 130 received into evidence. ) 


Or What is Exhibit 130? 


A. This is the DediPath subscriber information for the 


185.228.19.146/29 block, but our request was for the 


185.228.19.147. 


Okay. So what is a block? 
It is a group of IPs. 


O. So that IP address that you mentioned ending in .147, 


would that be contained within this IP block? 


And what is DediPath? 
A. DediPath is a U.S.-based hosting provider. 


On And what do these DediPath records indicate about the 


185.288.19.147 IP address that you obtained from Toppan 
Merrill? 


A. That AirVPN in Italy subscribed to those IPs. 
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Q. And what is AirVPN? 
A. AirVPN is a VPN provider, a virtual private network 
provider. 

And that's a commercial third-party VPN? 

Yes. 


ith respect to this 185.288.19.147 IP address, what, if 


tion did the FBI take? 


We obtained a pen register for this IP. 


And you testified about this earlier, but just to remind 


the jury, what is a pen register? 
A. It is the caller ID of who is communicating with that IP 
address. 

And who authorizes that? 


A federal judge. 


Q. For what period of time was the pen register on the 185 IP 
active? 
A. January and February of 2020. 


Q. Besides the 185 IP, did you obtain information from TM or 


DFIN about any other IP addresses that were used to access 


their systems that were associated with AirVPN? 
A. Yes. 
MR. FRANK: I'd like to call up 163 and 163A, and I'd 
offer them. 
(Exhibits Nos. 163 and 163A received into evidence.) 


What are these records? 
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A. If you look in the bottom left, these are subscriber 
records that go back to Quintex Alliance. 
Q. And what is Quintex Alliance? 
A. Quintex Alliance is a U.S.-based hosting provider. 
Q. And I want to direct your attention, in particular -- do 
you see the 199.249 series of IPs? 

Yes. 

In both of these records? 

Yes. 

Tell us about that IP address. 

This IP address was observed in the intrusions into the 
filing agents. 
oF And what IP address does that -- what company is that IP 
address associated with? 
Be AirVPN in Italy. 

MR. FRANK: And if we could leave up 163 on the left 

and put up 173 in evidence on the right. 


I'm sorry, 1731 in evidence. And if you could go to 


page 2. 


Q. Do you see that this is the Namecheap record we looked at 


earlier for the finshopland domain? 


MR. FRANK: Could we go to page 3. 


Do you see a 199.249.230.17 domain here? 
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And based on the record from Quintex on the left, who does 
domain come back to? 

AirVPN. 

I'm sorry, that IP address. I'm sorry. 

AirVPN. 

Special Agent, did you do further analysis of the 185 IP? 
Yes. 


MR. FRANK: Could we call up Exhibit 218, and I'd 


offer it. 
(Exhibit No. 218 received into evidence. ) 


What is Exhibit 218? 


This is an entry in the activity -- I described it as 


ler ID. This shows that the M-13 89 IP address 


-107.124.42 accessed the AirVPN 185.228.19.174 on January 29 


of 2020. 


OF So just to be clear, the dates at the top of the summary 


chart are January 28th, 2020, to February 23rd, 2020. 
Do you see that? 
Yes. 


What do those dates represent? 


The date range of the caller ID being set up on the 185 


That's when you had the pen register? 
Yes. 


And so on the day after you set up the pen register, there 
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was a hit from the M-13 IP on the AirVPN IP? 
A. Correct. 
O': On January 29th at 4:59 PST? 
A. 
MR. FRANK: Ms. Lewis, if you could leave up 


Exhibit 218 on the left, and if we could put up Exhibit 196 on 


the right. And I offer it, along with 196A, which we'll come 


to in a moment. 
(Exhibits Nos. 196 and 196A received into evidence.) 


Q. What is Exhibit 196 on the right? 


A. It is an image that was found inside the Vladislav 


Klyushin Apple account. 
Q. Did you have that image translated? 


A. Yes. 


MR. FRANK: Could we look at 196A in evidence, please. 


Oi. What is the image? 


A. The image is a screenshot of a Russian Standard Bank 


application that was identified in an exchange with an 


individual at the bank. 
An exchange between whom and an individual at the bank? 


Vladislav Klyushin and an individual that was at the bank. 


Mr. Klyushin had a communication with an individual at 
this bank and this image was exchanged? 
A. Correct. 


O' What is the date that the image indicates of the last 
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login -- the last access to online banking at Russian Standard 
Bank? 

A. January 29, 2020. 

Q. How does that compare with the date of the -- of the M-13 
IP address's access to the AirVPN IP? 

A. It's the same day. 

Q. What IP address did Mr. Klyushin use to access Russian 
Standard Bank? 

A. The M-13 89 IP address. 


Q. Ending in .42? 


A. COFrrect. 


oF Which is the M-13 IP address that was used that same day 


to access AirVPN? 
A. The same 89.107.124.42. 


Q. Thank you. 


MR. FRANK: Could we look at Exhibit 220, please. 


What is Exhibit 220? And this is multiple pages? 


Yes. 


What is it, Special Agent? 
MR. FRANK: And I'd offer it. 
(Exhibit No. 220 received into evidence. ) 
A. This is common IP addresses used to access the Ivan 
Ermakov iTunes account, as well as the 185 AirVPN IP address. 
Q. So to the extent that this chart depicts IP addresses that 


were used to access Mr. Ermakov's iTunes account, where did 
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those records come from? 

A. Apple. 

Q. And to the extent that this summary chart indicates access 
to the AirVPN IP, where did those records come from? 


A. DediPath. 


Q. So just -- and that was pursuant to the pen register? 


A. That was the caller ID on that 185 AirVPN IP. 


Q. Okay. So just to walk through this chart. You see that 
there's a 31 IP address? 
A. 
When was that 31 IP address used, generally, to access 
Ermakov's iTunes account? 
Early 2017. 
When was that same IP address used to access AirVPN? 
Three years later, in February of 2020. 
What about the next one, the 79 IP? When was it used to 
access Mr. Ermakov's iTunes account? 


February of 2018. 


When was it used to access AirVPN? 

Two years later, February in 2020. 

When was the 80 IP address listed below used to access 
Ermakov's iTunes account? 

December of 2019. 

When was that same IP address used to access the AirVPN 


185 IP? 
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A. Several months later, in February of 2020. 


Q. And just to be clear, how long were you up on that AirVPN 


IP using a pen register? 
A. January and February of 2020. 
MR. FRANK: Could we go to the next page. 


Q. When was the 94 IP address depicted used to access 


Mr. Ermakov's iTunes account? 

February of 2020. 

When was it used to access the AirVPN 185 IP? 

February of 2020. 

What about the 109 IP depicted next, when was it used to 
access Mr. Ermakov's iTunes account? 
A. June 2020. 

When was it used to access the 185 AirVPN IP? 


Four months earlier, in February of 2020. 


Q. What about the 109 IP depicted next, Special Agent? 
was it used by Mr. Ermakov to access iTunes? 


A. May of 2020. 


Q. When was it used to access the AirVPN 185 IP? 

A. Earlier that year, in February of 2020. 

Q. What about the 176 IP depicted next, when was it used to 
access Mr. Ermakov's iTunes account? 

A. June 2019. 

Q. When was it used to access the AirVPN 185 IP? 


A. Months later, in February of 2020. 
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When was the 213 IP depicted at the bottom of the page 
to access Mr. Ermakov's iTunes account? 

May 2019. 

When was it used to access the AirVPN 185 IP? 

February of 2020. 

Thank you, Special Agent. 


MR. FRANK: Could we look at Exhibit 219, please. And 


I'd offer 219. I'm not sure I offered 220, but I offer it now. 
THE CLERK: You did. 
MR. FRANK: Thank you. 
(Exhibit No. 219 received into evidence. ) 
What is 219? 
This is use of the other 89 IP, 89.238.166.235, used to 
access the AirVPN IP. 
Q. So just to be clear, this is the 89 IP that does not come 


back directly to M-13? 


A. Yes, that's correct. 


Q. This is the 89 IP that we looked at on those Namecheap and 


virtual server records? 

A. Correct. 

Q. And this 89 IP -- these records are derived from your pen 
register? 

A. Yes, the AirVPN caller ID. 


Q. So during the one-month period that you were up on the 


AirVPN 185 IP, what do these records depict? 
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A. That there were numerous access to the 185 pen, 


approximately 20 hits. 


O'. What was the first date -- so you went up on the AirVPN 


pen register on January 28th? 

A. 

On What was the first date that this 89 IP connected with the 
AirVPN 185 IP? 


The next day. 


And the pen register was terminated on February 23, 2020? 

Yes. 

What was the last date that the 89 IP connected with the 
AirVPN 185 IP? 


A. The day prior, February 22. 


MR. FRANK: Thank you, Ms. Lewis, you can take this 


down. And could you please call up Exhibit 221, and I'd offer 


it. 
(Exhibit No. 221 received into evidence. ) 


Q. What is Exhibit 221? 


A. This is use of the IP address 119 -- the 119 IP, 


119.204.194.11, to access the Ivan Ermakov iTunes. 


Oo. So this is an -- a different IP address that was used to 
access Mr. Ermakov's iTunes account on May 9th, 2018; is that 
correct? 

A. 


O» What time in Pacific Time did the -- Mr. Ermakov access 
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iTunes from the 119 IP? 

A. May 9, 2018, at 12:44 a.m. Pacific. 

OQ. And what does that translate to in Coordinated Universal 
or Zulu Time? 

A. May 9, 2018, 7:44 a.m. 

Q. that same day, did you obtain any records from DFIN 


about IP addresses from which its servers were accessed? 


A. 


MR. FRANK: Could we call up Exhibit 195A, please. 
And I'd offer it. 


(Exhibit No. 195A received into evidence. ) 


Q. What is Exhibit 195A? 


A. This is when certain files were downloaded, by way of the 


Julie Soma account, from the 119.204.194.11, the 119 IP 


address. 
MR. FRANK: Ms. Lewis, if you would put this on the 


right and put Exhibit 221 in evidence on the left, or vice 


versa. 


Or Directing your attention to May 9, in the summary chart of 


the DFIN logs. 


Do you see that? 


A. Yes. 


Q. At what time, Zulu Time, was the 119 IP used to download 


files from DFIN using the Julie Soma user ID? 


A. Beginning at 7:48, ending on 7:56 Zulu. 
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Okay. And that's -- 

Universal Coordinated Time. 
O'. And that's between 48 minutes after midnight and 56 
minutes after midnight, Pacific Time? 
A. 


Ox How many minutes was that first download after Mr. Ermakov 


used that same IP address to access his personal iTunes 
account? 

MR. NEMTSEV: Objection. 

THE COURT: Overruled. 
A. 44 to 48 is four minutes. 
Q. But just to be clear, at 12:44 a.m. Pacific Time, there 
was an access to Mr. Ermakov's iTunes account from the 119 IP? 
A. 


Q. Four minutes later, that same IP address shows up at DFIN 


using the Julie Soma user ID to download files associated with 


Horizon Pharma? 


A. Yes. 


MR. FRANK: Could we, on the right, look at 249B, 
please, and I'd offer it. 
(Exhibit No. 249B received into evidence. ) 
What is 249B? 
This is a screenshot of a filing for Horizon Pharma on May 
2018. 


And you see that it's an 8-K? 
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A. 
Q. What time was the Horizon Pharma 8-K filed with the SEC on 
May 9, 2018? 
A. 7:06 a.m. Eastern. 
on How does that compare with the time in Pacific Time that 
Horizon Pharma's file was downloaded from the -- from DFIN? 
A. It's 3:00 a.m. versus 7:00 a.m. 
Q. So the download was before or after the filing? 
A. The download occurred hours before the filing happened. 
MR. FRANK: Could we look at 249D on the right. And 
i'd. offer it. 
(Exhibit No. 249D received into evidence. ) 
What is 249D? 
This is an SEC filing screenshot from the EDGAR system. 
And this reflects the 10-Q of a company called Puma -- 
VES 
-- Biotechnology? 


What time -- what day was the Puma Biotechnology 10-Q 


filed? 
A. The next day, May 10th. 


Q. I think you jumped the gun on me there, Special Agent. 


What day was it filed with the SEC? 


A. May 10, 2018. 


Or. And if we look at the chart on the left, what day was 


there a download from Puma -- from DFIN for files associated 
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with Puma Biotechnology? 
A. The day prior, May 9. 
MR. FRANK: And, Ms. Lewis, could you just make the 
chart on the right a little bit smaller? 
And what was the document that was downloaded from DFIN? 
PBYI 10-Q master. 
And what was the document that was filed with the SEC? 
The 10-0. 


MR. FRANK: Could we look at Exhibit 249E on the 


right, please. I'd offer it. 

(Exhibit No. 249E received into evidence. ) 
at is 249K? 
is is an SEC filing for CytomX Therapeutics. 
d what is the filing? 


8-K. 


And what is the date and time that the CytomX 8-K was 


filed with the SEC? 
e 8-K and the 99 were filed on May 9th, 2018. 
d Exhibit 99.1? 


e accompanying 99.1 was filed at the same time on May 


is 
At what point? 
4:05 p.m. Eastern. 
O.. What does the chart on the left indicate about when 


Exhibit 99 for CytomX Therapeutics was downloaded from DFIN? 
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12:53 Pacific, which would have been 3:53 Eastern, a.m. 

So before or after the filing? 

Before, prior. 

MR. FRANK: Could we look, finally, at 249F on the 

right. 

What is 249F? 

A screenshot from the EDGAR database of a Synaptics 8-K. 

And there's an Exhibit 99.1 as well? 

And accompanying exhibits, yes. 

And what is the date and time that the Synaptics filings 

filed with the SEC? 

May 9, 2018, at 4:22 p.m. 

And directing your attention to the chart on the left, 


was there a download of Synaptics documents from DFIN? 


May 9, 2018, at 12:56 a.m. Pacific, which would be 3:56 
EBastern. 
MR. FRANK: Thank you, Ms. Lewis, you can take this 


down. 


Ov. Special Agent, for the next portion of your direct exam, 


I'd like to introduce another chalk. 


MR. FRANK: This is marked as BBB. 


THE COURT: Do you want to stand and stretch fora 


minute? You can see why a full day might be a lot. 
MR. FRANK: Your Honor, I wasn't sure if there was a 


juror question. 
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THE COURT: Oh, was there? I'm sorry. I missed that. 


THE CLERK: That was my fault. I was doing other 


THE COURT: I'll give this to them. We're not going 


to finish him today. I'll give it to the attorneys after we 


break. 

THE CLERK: I can make copies of it. 

THE COURT: She'll make copies and give it to them. 
We'll finish, hopefully, the government's direct today, but not 
the whole -- 

MR. FRANK: Maybe not guite, but close. 

THE COURT: Okay. Let's see if we can finish the 


Thank you. Don't forget, we have cross. 


MR. NEMTSEV: I will not be nearly as long, Your 


THE COURT: What? 


MR. NEMTSEV: I will not be nearly as long, I promise. 


BY MR. FRANK: 


Q. Special Agent, I've put up a chalk of a number of 


different companies, and I'd like you to walk the jury through 


what each of those companies are. 

Beginning at the top of the chalk, there's an entity 
referred to as ARIN, A-R-I-N. What is ARIN? 
A. The American Registry of Internet Numbers. 


Ow. What is it? 
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A. It is a registry of IP blocks and to whom they are 
associated. 

So it's an IP address registry? 

Yes. 

The next entity down is a company called Web2Objects. 

is Web20b jects? 

It is a company that leases IP blocks to the public. 

So you can get an IP block from Web20Objects and pay for 


and it will be registered with ARIN? 


A. Correct. 
Ox The next company down is called StackPath. What is 
StackPath? 


A. StackPath is a parent company of several VPN providers. 


Q. And are you familiar with a company called Mudhook 
Marketing? 
A. YES < 

Is that a subsidiary of StackPath? 


Yes. 


What about StrongVPN? 
StrongVPN, yes. 


And there are others? 


TPVanish is another one. 


TPVanish? 


Yes. 


Okay. So how does StackPath relate to Web2O0bjects on this 
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chalk? 


A. Web20bjects leased StackPath certain IP blocks. 


OQ. And then below StackPath, there's a company called Micfo. 
What is Micfo? 

A. Micfo procures rack space, which is a cage inside of a 
building to put computer hardware. 

Q. And do they also lease server space as well for IP 
addresses? 

A. They do. 

Q. And what was the relationship that we're going to talk 


about in a minute between Micfo and StackPath? 


A. Micfo provided that storage space within a rack and a cage 


to StackPath. 
Is Micfo still in existence? 
No. 
What happened to Micfo? 
They were indicted in 2019. 


And were they convicted of a crime? 


company, yes. 
that crime have anything to do with what we're talking 
this -- 


MR. FERNICH: Objection. 


MR. NEMTSEV: Objection. 
THE COURT: Sustained. 


Do you know what that crime was? 
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Yes. 

Was it related to the events we're discussing here? 

No. 

Below Micfo, there's a company called Markley. What is 
Markley? 
A. Markley is a datacenter that is located a few blocks from 
the courthouse. 

So it's a company that owns a building? 


Yes, the real estate where these servers would be housed. 


And that building is on Summer Street in Boston? 


Yes. 


Okay. And so what relationship did Markley have with 


Micfo? 


A. Markley provided a temperature-controlled -- a powered-on 


environment for high-powered servers to be safely secured and 
have 24/7 operation. 


So Micfo rented space from Markley? 


Yes, real estate. 


And Micfo rented server space to StackPath? 
Correct. 
And StackPath procured IP addresses from Web20bjects? 


Yes. 


And those were registered with ARIN? 
Yes. 


Now, off to the left, there's an entity called Cogent. 
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What is Cogent? 


A. Cogent is a backbone Internet provider. They route these 


IPs we were talking about all over the world. 


Os Okay. Thank you, Special Agent. 


MR. FRANK: I'd now like to call up Exhibit 191, and I'd 
offer it. 
(Exhibit No. 191 received into evidence. ) 


Q. What is Exhibit 191? 


A. These are downloads for the Julie Soma account from an 


entire IP block, 104.238.2 -- strike that. 104.238.37. 

Q. And what period were those downloads? 

A. October 2018 to November of 2018 was the entire range that 
was examined. 

Q. Okay. And these -- this summary came from records you 


obtained from where? Are these from DFIN records? 


A. These records are from Donnelley Financial, yes. 
Or, And so, to be clear, these summarize instances in this 


time period when the 104.238.37 IP was used to download files 


using Julie Soma's user ID? 

A. That is correct. 

Os Okay. I'd like to direct you to the entry under 
Capstead -- do you see there's two entries for Capstead 


Mortgage? 


What are the documents that were downloaded? 
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The 99.1 exhibit and the Q3 2018 press release workbook. 
And what time and day were they downloaded? 
October 22, 6:21 a.m. Pacific. 
MR. FRANK: And if we could put this exhibit up on the 

and 249H on the right. And I'd offer 249H. 

(Exhibit No. 249H received into evidence. ) 
at is 249H? 
is is the SEC screenshot for a Capstead Mortgage 8-K. 
d it's also an Exhibit 99.1. Do you see that? 


d the accompanying exhibit, yes. 


en were these documents filed with the SEC? 
October 24 at 5:00 p.m. Eastern. 
When was the download of Exhibit 99.1 and the 903 2018 


press release from DFIN's servers using Julie Soma's IP -- 


Julie Soma's user ID over the 104 IP address? 


A. Two days prior, on October 22nd, 2018. 


MR. FRANK: Could we go to page 2 on the left, 


Ms. Lewis. And on the right, could we call up Exhibit 249G, 


and I'd offer it. 


(Exhibit No. 249G received into evidence. ) 


Ol Directing your attention to the exhibit on the left, the 
summary chart, Special Agent, do you see there's an entry for 
Tesla? And what is the document that was downloaded? 

Pus The 99.1 exhibit. 


OF Okay. And if you look at that chart, what is the date and 
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time? 

A. October 24th, 2018, at 2:18 a.m. Pacific. 

Q. Directing your attention to 249G on the right, what date 
and time did Tesla file its 8-K and Exhibit 99.1 with the SEC? 
A. That same day, October the 24th at 4:27 p.m. 

Q. Was the download before or after the filing with the SEC? 


A. The download occurred before the filing. 


MR. FRANK: Could we look on the left at page 3, 


please, and on the right at Exhibit 2491, and I'd offer it. 


(Exhibit No. 249I received into evidence.) 

Q. On the summary chart on the left, do you see an entry in 
the middle of the page for SS&C Technologies? 

Yes. 

What is the document that was downloaded? 

The 99.1 exhibit. 

What is the date? 

October 26, 2018. 


What is the time? 


6:13 Pacific. 
On 2491, when did SS&C file its 8-K and Exhibit 99.1? 


October 31 at -- October 31, 2018, at 4:13 p.m. 


How many days before the filing was the download? 
Four. Or five, rather. 


MR. FRANK: Could we look at the summary chart, the 


next page, page 4. And on the right, could we call up 249d, 
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and I'd offer it. 
(Exhibit No. 249J received into evidence.) 
0. Special Agent, looking at the summary chart, do you see an 
entry at the top of the page for a company called Roku? 
A. Yes. 
Q. And do you also see an entry at the bottom of the page for 
Roku? 
A. 
Q. What were the documents that were downloaded on those two 
instances? 
A. Exhibit 99. 
Q. And when was the first download? 
A. November 6, 2018, at 1:05 a.m. Pacific. 
Q. Looking at the exhibit on the right, when did Roku file 


its 8-K and Exhibit 99.1? 


A. The next day, November the 7th, 2018, at 4:10 p.m. 


O. Were the downloads on the left before or after the filing 


of the 8-K and 99.1 on the right? 


A. Yes. They were before. 
MR. FRANK: Thank you. You can take this down. 


Q. This IP address, this 104 IP address from which these 


downloads occurred, were you able to identify any records 
concerning the location of that IP address? 
A. Could you put the IP address back up? 


MR. FRANK: Put up 191, please. 
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Do you see that IP block 104.238.37? 


Were you able to identify records associated with it? 
Yes. This is the 104 IP address. 
Yes. 
MR. FRANK: Could we look at Exhibit 140, please. And 
I'd offer it. 
(Exhibit No. 140 received into evidence. ) 


Q. What is Exhibit 140? 


Avs This is a Micfo invoice referencing the same block of 


104.238.37.0/24, that IP block. 


Qe And who is Micfo invoicing? 

A. Mudhook Marketing, which we have associated to StackPath. 
Q. Okay. So looking at our chart, this is Micfo, second from 
the bottom, invoicing StackPath -- or a subsidiary of 
StackPath, Mudhook Marketing, for the 104 IP block? 

A. Correct. 


QO. And what does the invoice indicate about the location of 


the block? 


A. Boston, Massachusetts. 


Os And what does it indicate about the server space where 


that particular server is located? 
A. U-07. 
oF Now -- and what is the address for Mudhook Marketing 


that's on this invoice? 
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1920 McKinney Ave., 7th floor, Dallas, Texas. 
And this invoice, what is the date of it? 


The date is July 25, 2019. 


Now, this exhibit consists of several invoices. 

MR. FRANK: I'd like to go to page 5 of the exhibit. 
Now, do you see page 5 of the exhibit, Special Agent? 
Yes. 

d what is page 5? 
other Micfo invoice to Mudhook Marketing. 


d what is the date of this invoice? 


e invoice date, November 24, 2018. 
Now, a moment ago we looked at that download chart, 


Exhibit 191. 


MR. FRANK: Ms. Lewis, could you call it up on the 
right, please, and go to page 4. 
Q. That Roku download on page 4, the one at the top and the 
one at the bottom, what dates did those occur? 


A. November 6 and November 7 of 2018. 


Q. And this invoice on the left is dated? 
A. November 24th, 2018. 


Os Okay. And if you look below, what is the IP address block 


referenced there? 
A. This is the 104.238.37.0/24, the same IP block. 


Q. Okay. What is the period for which Mudhook 


Marketing/StackPath is being invoiced? 
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A. December 1 of 2018 through December 31 of 2018. 


Q. And what is the server space where the server housing that 


IP address is located? 
A. U-07. 
Q. And this invoice at the top is -- it indicates it was 


unpaid? 


been able to establish whether it was, in fact, 


It was paid. 

And how do you know that? 

The company, StackPath, indicated -- 

Do you have bank records indicating that? 

I believe we do. 

And did you seek to obtain earlier invoices for that IP 
StackPath? 

Yes. 


What happened? 


They were unable to locate anything earlier than this time 


period. 


O.. And were you able to determine whether Micfo, in fact, 


leased datacenter space in Boston in October and November 2018? 


I'm showing you now Exhibit 142. 


MR. FRANK: And I'd offer it. 
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(Exhibit No. 142 received into evidence. ) 


Q. What is Exhibit 142? 


A. This is a contract between Markley Boston, the datacenter, 
and Micfo. 
So Markley's at the bottom of our chalk? 
Yes. 
And Micfo's one up? 
Yes. 
So this is a contract between Micfo and Markley? 
Yes. 
MR. FRANK: Can we go to page 2, please. 
What's the date of the contract? 
December 2015. 
MR. FRANK: And, Ms. Lewis, if you could expand a 
little further to the building. 
Q. What is the building that this contract references? 
A. 1 Summer Street, Boston, Mass. 


MR. FRANK: Could we go to page 7, please. 


And do you see signatures there? 


Yes. 


And those are representatives of which companies? 


Markley Boston and Micfo. 
MR. FRANK: Could we go to page 63, please. 
What is 63? 


63 is an invoice from Markley Boston to Micfo. 
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And what is the invoice date? 
September 14th, 2018. 
MR. FRANK: And could we go to page 65, please. 
And what is 65? 
Another Markley Boston invoice made out to Micfo. 
And what is the date? 
October 1 -- 
Is that October 11? 
October 11, 2018. 
MR. FRANK: And if we could back out. 
What is the period indicated, beginning? 


MR. FRANK: Down below that, Ms. Lewis. 


The period is November -- if we could zoom in, please. 


MR. FRANK: Ms. Lewis, could you zoom in just below 


November 1, 2018. 


And if you recall on those Micfo invoices to Mudhook 


Marketing, they reference the server in spot 7. 


Do you recall that? 
A. 


Q. Were you able to determine whether there was, in fact, a 


server in spot 7 in October of 2018? 
A. Yes. 


MR. FRANK: Could we look at Exhibit 142A, please, and 


I'd offer it. 
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(Exhibit No. 142A received into evidence. ) 


What is Exhibit 142A? 


This is a picture that Markley Boston provided to Micfo. 


Q. And what is the -- do you see there's -- there's some 
stickers on these machines? 
A. 


Q. I'm directing your attention to the sticker that I'm 


indicating. What does it say? 
A. BOS-SVR-7. 


Q. Okay. And directing your attention now to the blue 


sticker, do you see there's some letters and a -- it looks like 
a serial number? 

Yes. 

What are the first two letters? 

ST. 

And what are the first two letters of StackPath? 

ST. 


MR. FRANK: Could we look at Exhibit 142D, please, and 


I'd offer it. 
(Exhibit No. 142D received into evidence. ) 
Os What is 142D? 
A. The metadata associated with this photo depicting when it 
was taken. 
Q. When was this photo depicting a server in spot 7 taken? 


A. September 13th, 2018, 9:06 a.m. 
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Q. Were you able to determine, Special Agent, whether Micfo 
had an authorization for the 104 IP address in October of 2018? 
A. Yes. They'd had it for months by then. 

MR. FRANK: Could we look at Exhibit 145, please. 


What is Exhibit 145? 


A May 30, 2018 letter of authorization. 
And who is it from? 

It's from Web20Ob jects. 

So that's the company above StackPath? 
Yes. 


And what does it say? If you could read the first 


sentence, and the beginning of the next sentence. 
A. "Web2Objects authorizes Micfo to announce or readvertise 
the following IPv4 prefix." 


Q. And what is the first IPv4 prefix indicating? 


THE COURT: First of all, what is an IPv4 prefix? 


THE WITNESS: It is a reference to the version number 


of these IPs, and so the prefix would be 104.238.37.0/24. 


Q. That's the block? 


A. That's the block. 


Os And what does it indicate about where that block is 
located? 

A. It is preceded by the word "Boston." 

Q. Showing you now Exhibit 176. 


MR. FRANK: And I'd offer it. 
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(Exhibit No. 176 received into evidence. ) 


Where did you obtain Exhibit 176? 


ARIN. 

That's the registry at the top of our chalk? 
Yes. 

And what IP blocks does this reference? 


The 104.238.37.0/24. 


Okay. And you see that it also references Web2Objects? 
Yes. 
Okay. And Web20Objects is one entity down from ARIN on our 
chalk? 
A. VES 
MR. FRANK: And could we go to page 2, please. 
on Could you read the first sentence? 


A. "On June 18, 2018, at 20:36:55, Web20bjJects LLC reassigned 


104.238.37.0/24 to the following organization." 


What is the organization it was assigned to? 


Strong Technology, LLC. 


O: And Strong Technology, LLC, is a subsidiary of what 
company? 

A. StackPath. 

Q. And directing you to the billing address at the bottom, do 
you recognize that billing address? 

ae kor 


Is that the same billing address we saw on the Micfo 
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invoice? 
Az For Mudhook Marketing. 
O's Okay. And what is the address associated with the IP at 
the top of the page? 
A. 1 Summer Street, Boston, Mass. 

MR. FRANK: Could we look at Exhibit 267, please, and 
I'd of fEY 1b. 

(Exhibit No. 267 received into evidence. ) 


What is Exhibit 267? 


If we could zoom in, please. 


This is a May 30th, 2018, email sent from aditishah@micfo 
to the netops email address -- I'm sorry. Let me start over. 


This is an email from Cogent to aditishah@micfo and 


netops@micfo.com describing that work had been completed. 


Q. Okay. Let's start at the bottom of the chain. 
MR. FRANK: Ms. Lewis, if you could take us to the 
bottom of this document. 


Do you see there's an attachment, Special Agent? 


Yes. 

Do you recognize this attachment? 

Yes. This is the attachment to an email sent to Cogent. 
Do you recognize this particular document? 

Yes. 

Is this the letter of authorization from Web20Objects we 


looked at a moment ago? 
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A. The same letter of authorization, yes. 

Q. And if we then move up the document, do you see that 
there's an email dated May 30, 2018, from aditishah@micfo? 
A. Yes. 

Q. Okay. And what does it say? 


A. "Hello, Cogent. We have some IPv4 prefix filter updates. 


Please find attached the relevant LOA for the same. Please see 


the details below." 


And the first location? 


Boston. 


And the second location? I'm sorry. Before we get to 
that second location, could you indicate -- what is the IPv4 
prefix assigned to Boston? 


104.238.37.0/24. 


And that's the same block we've been talking about? 
Yess 


And do you see that, as the email goes on, there are other 


IP blocks for other cities? 


A. Yes. 
Cleveland, Denver? 
Yes. 
Milwaukee and St. Louis? 


Yes. 


And to whom did Ms. Shah at Micfo send this request? 


support@cogentco.com and copied netops@micfo.com. 
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Okay. And if we go to the top of the document, do you see 


is the response from Cogent? 
Yes. 


d what is the date? 


e same date -- or -- can we go back to the other? 


d your question again, sir? 


at is the date that Cogent responded to Micfo? 
May 30, 2018. 
Okay. And could you read what Cogent wrote back? 
"Dear Cogent customer, your BGP prefix list addition has 
completed." 
Okay. If we go down the list, you see there's a whole 
series of Internet -- of IP addresses? 
A. Yes. 
MR. FRANK: Could we go to the second page, please. 


And, Ms. Lewis, could you highlight. 


Ol. Do you recognize the IP block that Ms. Lewis has 
highlighted? 

Yes. 

What is it? 

The: 104,238.37.0/24. 

And so Cogent is that company on the left on our chalk? 

Yes. 

Thank you, Special Agent. 


MR. FRANK: Your Honor, I have one last section, but 
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I'm not going to be able to complete it in the next couple of 
minutes. 
COURT: We have two minutes. 
FRANK: I'm happy to start, but. 
COURT: Yes. 
MR. FRANK: Okay. 


Ox Special Agent, in addition to the WhatsApp messages we 


reviewed earlier, did the FBI find any messages on other 


messaging services in the iCloud backups you reviewed? 
A. Yes. 


MR. FRANK: Ms. Lewis, could we call up Exhibit 46, 


and I'd offer it. 
(Exhibit No. 46 received into evidence. ) 
And, Ms. Molloy, did I offer 176 and 267? 
THE CLERK: Mm-hmm. They're in. 
MR. FRANK: Thank you. 
THE CLERK: You're welcome. 


Q. What is Exhibit 46? 


A. This is the Threema chat content located in the Nikolai 
Rumiantcev Apple account. 


Q. What is Threema? 


A. Threema is a chat program that allows two or more 


individuals to message back and forth. 


O's And is Threema encrypted or unencrypted? 


A. Encrypted. 
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O's If Threema is encrypted, how were you able to obtain the 
unencrypted content of the Threema chat that was backed up to 


Mr. Rumiantcev's iCloud account? 


A. It existed in an unencrypted state within the Apple backup 
for Nikolai's account. 


Os Now, earlier you testified about a WhatsApp chat that was 


found on Mr. Klyushin's iCloud account. 
Do you recall that testimony? 
A. 
OQ. And on WhatsApp, how were you able to identify senders and 
recipients? 
Phone number. 
Are Threema accounts registered using phone numbers? 
No. 


So how are the communications identified in a Threema 


chat? 


A. An alphanumeric string. 


Q. So are you able to identify who the senders and recipients 


are based on those alphanumeric strings? 


A. If that's all you had, no. 


QO. Were you able to do that in this case, were you able to 


identify the speakers in this chat in this case? 


A. Yes, we were able to identify which code -- which 


alphanumeric code was associated with what individual. 


Or. How were you able to do that? 
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A. We analyzed these communications, along with other 
communications that we've previously discussed. The WhatsApp 
communications -- for one, the WhatsApp communications between 


Vladislav Klyushin and Ivan Ermakov. 


THE COURT: This might be a good time to break. 
MR. FRANK: Thank you, Your Honor. 


THE COURT: I'll see you tomorrow. 


THE CLERK: All rise. 
(Jury exits.) 
THE COURT: So I will not consider any documents that 


you give to them after 5:00 this afternoon. So just get it 


going. I mean, if they already have it, that's one thing, but 


new documents, it's just too much. 


Now, how much longer do you have with him? 


MR. FRANK: I have the Threema chat and the closing 


section. I would say probably about a half hour. 


THE COURT: So how long do you think you're going to 


MR. NEMTSEV: I'm going to try to make it an hour. 

THE COURT: Who's next? 

MR. FRANK: Jeff Zorek from Saxo Bank. His testimony 
is probably an hour or less. 


MR. NEMTSEV: Aren't we playing an hour-and-40-minute 


MR. FRANK: Not the entire call. I'm going to 
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introduce the entire call, and I'm going to have him describe 


the first part of the call, and then the second part of the 
call where he's asking questions and getting answers is going 
to be played. 

THE COURT: We don't have to do that in front of me 
right now, but let me just say that -- how long, do you have 
any idea, on cross? 

MR. FERNICH: I might be a bit. 


COURT: The rest of the day? 


MR. FERNICH: So you said it would be a half hour. 


Yeah, I think that will take up tomorrow. 


THE COURT: These people are all people from out of 


MR. FRANK: Yes. 


THE COURT: Do you know if any of them will have 


trouble getting here? 
MR. FRANK: He has -- what is tomorrow? 


MR. KOSTO: Tomorrow is Friday. 


MR. FRANK: We do need to get him home tomorrow, but I 


THE COURT: MaryEllen was whispering to me it's our 


typical rule if there's a snowstorm and there's no school in 


Boston, we don't have court. There's not going to be a 
snowstorm tonight, but there is going to be record cold. So 


there's a chance some of the schools will be closed. So 
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there's sort of a gray area about what we do. So I wanted to 


know whether or not it would be a hardship because some of 


these people are flown in from out of town and I didn't want to 


pop that on you. 

MR. FRANK: I could take him out of order. We're ata 
point in the direct examination of Special Agent Hitchcock 
where we could pause, put on Mr. Zorek and get him out of here 
and then conclude Special Agent Hitchcock. 

THE COURT: How do you feel about that? 

MR. NEMTSEV: I have no preference. If Mr. Zorek 
needs to be home, I understand. 

THE COURT: Well, let him know either way. Even 
though it's our normal rule, no school in Boston, no court, the 
reality is that's geared toward snowstorms as a proxy for 
whether you can get here or not, but I think tomorrow is just 
supposed to be cold. 

MR. KOSTO: Did the Court see any hands for whether it 


would be an issue? 


THE COURT: Yes, but she said it wouldn't be an issue. 
It's designed for snowstorms, is the thing. 

So in any event, here's the juror question. 

MR. FRANK: I can ask this tomorrow. 

THE COURT: Okay. 


Let me also say, at some point I just need to figure 


out the jury instructions. So if, in fact, we finish Saxo -- 
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the Saxo representative and this agent tomorrow, what does that 


look like for Monday? 

MR. KOSTO: The government has four more witnesses 
after Mr. Zorek, a summary witness, Ms. Yanochko from our 
office who's going to testify to some summary information, and 
then two technical witnesses beyond Agent Hitchcock, and then 


an SEC witness. And that's it. 


MR. NEMTSEV: Mr. Clarke. 

THE COURT: All right. But when does that bring us 
to? I'm trying to figure out when I need to have a charge 
conference. 


MR. FRANK: Probably through Tuesday. 


THE COURT: It will bring you through Tuesday. So if 


we did a charge conference, perhaps, Tuesday afternoon, 


potentially Wednesday afternoon, depending how it goes. Do you 


have a sense yourself right now? 


MR. NEMTSEV: I think we'd be done in one day. 


THE COURT: That's what worries me. You've listed all 


these people. 


MR. NEMTSEV: I listed only three people, and two 


experts will testify. I don't know if I need -- 

THE COURT: So it could go to the jury, say, Thursday 
or Friday? 

MR. NEMTSEV: Potentially. 


COURT: Potentially, at least. I'm just trying to 
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figure out -- 

MR. NEMTSEV: We could push it to Monday, if that's 
what Your Honor prefers. 

THE COURT: I'd prefer to finish it sooner rather than 
later because I lose people from COVID, but they've been 
terrific. 

If you understand this question, ask it. Go ahead. 


It's a little more detailed than some of the other ones. 


MR. NEMTSEV: I'm not quite sure this is the right 


witness for this question, but. 


MR. FRANK: He can answer the question. 


MR. KOSTO: He can answer this question. 


THE COURT: Let me also say, like I did with the 


pictures, I'm scribbling away. There's no way they're going to 


remember all these different IP addresses. 


MR. NEMTSEV: I lost it halfway through. 


THE COURT: I'm being -- you know -- I'm scribbling 


MR. KOSTO: It will be our job in closing to bring 
this together for the jury. 


THE COURT: I know, but I need to understand it for 


directed verdict. And, also, people aren't -- maybe there are 
a few who have photographic memories, but they've got to 


remember it. They've got to be able to link it all together, 


and so -- as do I. I finally heard the connection with Ermakov 
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the iTunes account, but, you know, like you don't want 


to do just a big lump everything together kind of thing. 
for you, are you going to be doing anything like that? 


MR. NEMTSEV: I'll point out some issues with the 


connections, but that's about it. 

THE COURT: I'm just saying you're assuming a lot of 
memory on their part on the numbers and what connects to what. 
You know, today was an important day, I understand that. There 


were a couple of immediate links, especially to Ermakov, but 


how are they going to remember all those numbers? 
MR. FRANK: Judge, I don't know what to say to that. 


We're going to link it together in closing. I think we 


established very clearly today that the M-13 IP address was 
directly connected to the hack, and Mr. Ermakov and 


Mr. Rumiantcev and Mr. Klyushin all used that IP address. 


THE COURT: Let me say, you can argue that. I am 


simply saying, you are assuming a lot of memory, especially 


going over a weekend, and it's very useful to have someone 


write down to teach what are the different numbers so that -- 
it may be that they'll convict -- they'll want to convict, say, 
Ermakov, but it may be they're -- they may have trouble linking 
it to Klyushin. Or they may find that the whole M-13 is 


+ 


involved, but, whatever, it's a lot of numbers you've been 


using. That's all I'm saying. 


MR. FRANK: I don't know what Your Honor is 
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suggesting. We're doing our best. We've tried to move it 
along. We have summary charts and we've tried to be as 
pedantic as we can. 

THE COURT: Whatever you think you are, I would like a 


memo on directed verdict linking it all together when we get to 


that point, just to make sure that I understand, rather than 


before I get to closings, because I'm sure I will have a motion 


for directed verdict, and I think I need from you, if you're 
moving for directed verdict, why it is that there are gaps. 

MR. NEMTSEV: Okay. That's easy. 

THE COURT: It may not be easy, but -- so someone -- I 
know this may be weekend work, but it would be very useful to 
have a brief on the inevitable motion for directed verdict that 


sets out how you get to reasonable doubt. I actually think 


today the venue issue sort of dissipated, but I haven't heard 
your cross yet. 
MR. FERNICH: One more question. Have we worked out 


on the Threema chat the 403 objections? Or if we are going to 


take Zorek out of order, maybe it can wait. 
MR. FRANK: We can talk about it. I don't have 


concerns about most of the redactions you requested. To the 


extent you have hearsay objections to a chat that you're 


introducing -- you want to introduce hearsay from, I do -- we 


are not going to agree on that. 


MR. NEMTSEV: This would be an unidentified 
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co-conspirator. 


MR. FRANK: We're not going to do this in the 
abstract, counsel. 

THE COURT: I don't know, but I'll see you at 8:30 
tomorrow morning. 


(Proceedings adjourned at 1:12 p.m.) 
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